feat(pos/facturapi): add organization setup flow and detailed status

- get_org_status now returns has_key, has_org_id, pending_steps, error
- add find_organization_by_rfc and create_organization helpers
- add /facturapi/setup endpoint to link/create Facturapi org
- frontend shows detailed PAC status and setup button
- support using tenant sk_user_* key when FACTURAPI_USER_KEY env is absent

pos/blueprints/invoicing_bp.py

@@ -560,6 +560,60 @@ def facturapi_status():
     return jsonify(status)
 
 
+@invoicing_bp.route('/facturapi/setup', methods=['POST'])
+@require_auth('invoicing.create')
+def facturapi_setup():
+    """Create or link a Facturapi organization for this tenant.
+
+    Requires FACTURAPI_USER_KEY environment variable.
+    Stores cfdi_facturapi_org_id and cfdi_facturapi_key in tenant_config.
+    """
+    conn = get_tenant_conn(g.tenant_id)
+    cur = conn.cursor()
+
+    try:
+        tenant_config = _get_issuer_config(cur)
+        if not tenant_config.get('rfc'):
+            return jsonify({'error': 'Tenant RFC not configured'}), 400
+
+        result = facturapi_service.create_organization(tenant_config)
+
+        cur.execute("""
+            INSERT INTO tenant_config (key, value)
+            VALUES ('cfdi_facturapi_org_id', %s)
+            ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+        """, (result['org_id'],))
+
+        cur.execute("""
+            INSERT INTO tenant_config (key, value)
+            VALUES ('cfdi_facturapi_key', %s)
+            ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+        """, (result['api_key'],))
+
+        log_action(conn, 'FACTURAPI_SETUP', 'tenant_config', None,
+                   new_value={'org_id': result['org_id']})
+
+        conn.commit()
+        cur.close()
+        conn.close()
+
+        return jsonify({
+            'org_id': result['org_id'],
+            'message': 'Facturapi organization created. Complete pending steps in Facturapi dashboard.',
+        })
+
+    except ValueError as e:
+        conn.rollback()
+        cur.close()
+        conn.close()
+        return jsonify({'error': str(e)}), 400
+    except Exception as e:
+        conn.rollback()
+        cur.close()
+        conn.close()
+        return jsonify({'error': str(e)}), 500
+
+
 @invoicing_bp.route('/facturapi/download/<int:cfdi_id>/<doc_type>', methods=['GET'])
 @require_auth('invoicing.view')
 def facturapi_download(cfdi_id, doc_type):