fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/migrations/runner.py

@@ -53,6 +53,10 @@ MIGRATIONS = {
     "v4.4": "v4.4_workshop.sql",
     "v4.5": "v4.5_customer_max_discount.sql",
     "v4.6": "v4.6_inventory_support.sql",
+    "v4.7": "v4.7_workshop_business.sql",
+    "v4.8": "v4.8_workshop_permissions.sql",
+    "v4.9": "v4.9_workshop_customers_view.sql",
+    "v4.10": "v4.10_fleet_permissions.sql",
 }
 
 

pos/migrations/v4.10_fleet_permissions.sql

@@ -0,0 +1,20 @@
+-- v4.10: add fleet RBAC permissions for existing employees.
+-- Owner and admin get full fleet access; accountant and workshop get read access.
+
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT e.id, p.perm
+FROM employees e
+CROSS JOIN (VALUES
+    ('fleet.view'),
+    ('fleet.create'),
+    ('fleet.edit'),
+    ('fleet.delete')
+) AS p(perm)
+WHERE e.role IN ('owner', 'admin')
+ON CONFLICT (employee_id, permission) DO NOTHING;
+
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT e.id, 'fleet.view'
+FROM employees e
+WHERE e.role IN ('accountant', 'workshop')
+ON CONFLICT (employee_id, permission) DO NOTHING;

pos/migrations/v4.7_workshop_business.sql

@@ -0,0 +1,11 @@
+-- v4.6 Workshop business fields
+-- Adds delivery method, courier assignment and direct-order flag to service orders.
+
+ALTER TABLE service_orders
+    ADD COLUMN IF NOT EXISTS delivery_method VARCHAR(30),
+    ADD COLUMN IF NOT EXISTS courier_id INTEGER REFERENCES couriers(id),
+    ADD COLUMN IF NOT EXISTS is_direct BOOLEAN DEFAULT FALSE;
+
+CREATE INDEX IF NOT EXISTS idx_service_orders_delivery_method ON service_orders(delivery_method);
+CREATE INDEX IF NOT EXISTS idx_service_orders_courier_id ON service_orders(courier_id);
+CREATE INDEX IF NOT EXISTS idx_service_orders_is_direct ON service_orders(is_direct);

pos/migrations/v4.8_workshop_permissions.sql

@@ -0,0 +1,15 @@
+-- v4.8 Workshop permissions seed
+-- Grants workshop permissions to existing admin employees so they keep access
+-- after the new role-based restrictions are enforced.
+
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT id, 'workshop.view'
+FROM employees
+WHERE role = 'admin'
+ON CONFLICT DO NOTHING;
+
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT id, 'workshop.edit'
+FROM employees
+WHERE role = 'admin'
+ON CONFLICT DO NOTHING;

pos/migrations/v4.9_workshop_customers_view.sql

@@ -0,0 +1,7 @@
+-- v4.9: Grant customers.view permission to existing workshop employees
+-- so they can load the customer list when creating service orders.
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT e.id, 'customers.view'
+FROM employees e
+WHERE e.role = 'workshop'
+ON CONFLICT (employee_id, permission) DO NOTHING;