fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/services/accounting_engine.py

@@ -46,18 +46,22 @@ def _get_account_id(cur, code):
 
 def _get_account_ids(cur, codes):
     """Look up multiple account IDs by code. Returns dict {code: id}."""
-    result = {}
-    for code in codes:
-        result[code] = _get_account_id(cur, code)
-    return result
+    cur.execute(
+        "SELECT code, id FROM accounts WHERE code = ANY(%s) AND is_active = true",
+        (list(codes),)
+    )
+    rows = {row[0]: row[1] for row in cur.fetchall()}
+    missing = set(codes) - set(rows)
+    if missing:
+        raise ValueError(f"Account(s) with code {sorted(missing)} not found")
+    return rows
 
 
 def get_next_entry_number(conn):
     """Get the next sequential journal entry number.
 
-    Uses a simple MAX+1 approach. For high-concurrency environments this
-    could be replaced with a sequence, but for single-tenant refaccionarias
-    the transaction-level lock from the INSERT is sufficient.
+    Uses a transaction-level advisory lock to prevent duplicate numbers
+    when multiple journal entries are created concurrently.
 
     Args:
         conn: psycopg2 connection to tenant DB
@@ -66,6 +70,7 @@ def get_next_entry_number(conn):
         int: next entry number (starts at 1)
     """
     cur = conn.cursor()
+    cur.execute("SELECT pg_advisory_xact_lock(hashtext('journal_entry_number'))")
     cur.execute("SELECT COALESCE(MAX(entry_number), 0) + 1 FROM journal_entries")
     number = cur.fetchone()[0]
     cur.close()