fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/blueprints/config_bp.py

@@ -151,7 +151,7 @@ def update_branch(branch_id):
 
 
 @config_bp.route('/employees', methods=['GET'])
-@require_auth('config.view')
+@require_auth()
 def list_employees():
     conn = get_tenant_conn(g.tenant_id)
     cur = conn.cursor()
@@ -200,7 +200,7 @@ def create_employee():
         nxt_name = PLANS[nxt]['name'] if nxt else 'Enterprise'
         return jsonify({'error': f'Plan limit reached ({limit} employees). Upgrade to {nxt_name}.'}), 403
 
-    valid_roles = ['admin', 'cashier', 'warehouse', 'accountant']
+    valid_roles = ['admin', 'cashier', 'warehouse', 'accountant', 'workshop']
     if data['role'] not in valid_roles:
         return jsonify({'error': f'role must be one of: {", ".join(valid_roles)}'}), 400
 
@@ -223,15 +223,22 @@ def create_employee():
                    'customers.view', 'customers.create', 'customers.edit', 'customers.edit_credit',
                    'invoicing.view', 'invoicing.create',
                    'reports.view', 'reports.financial',
-                   'config.view', 'config.edit', 'config.edit_prices'],
+                   'config.view', 'config.edit', 'config.edit_prices',
+                   'workshop.view', 'workshop.edit',
+                   'fleet.view', 'fleet.create', 'fleet.edit', 'fleet.delete'],
         'cashier': ['pos.sell', 'pos.discount', 'pos.cancel',
-                     'catalog.view', 'customers.view', 'customers.create'],
+                     'catalog.view',
+                     'inventory.view', 'inventory.create',
+                     'customers.view', 'customers.create'],
         'warehouse': ['inventory.view', 'inventory.create', 'inventory.edit',
                        'inventory.adjust', 'inventory.transfer', 'catalog.view'],
         'accountant': ['accounting.view', 'accounting.create',
                         'invoicing.view', 'invoicing.create', 'invoicing.cancel',
                         'reports.view', 'reports.financial',
-                        'customers.view'],
+                        'customers.view',
+                        'fleet.view'],
+        'workshop': ['workshop.view', 'workshop.edit', 'workshop.add_items', 'customers.view',
+                     'fleet.view'],
     }
 
     for perm in role_permissions.get(data['role'], []):