fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/services/cfdi_queue.py

@@ -29,8 +29,13 @@ MAX_RETRIES = len(BACKOFF_INTERVALS)
 
 
 def _generate_provisional_folio(conn):
-    """Generate a provisional folio like PRE-00001."""
+    """Generate a provisional folio like PRE-00001.
+
+    Uses a transaction-level advisory lock to avoid duplicate provisional
+    folios when multiple CFDIs are enqueued concurrently.
+    """
     cur = conn.cursor()
+    cur.execute("SELECT pg_advisory_xact_lock(hashtext('cfdi_provisional_folio'))")
     cur.execute("SELECT COALESCE(MAX(id), 0) + 1 FROM cfdi_queue")
     seq = cur.fetchone()[0]
     cur.close()
@@ -101,6 +106,7 @@ def process_queue(conn, tenant_config, dry_run=False):
           AND retry_count < %s
         ORDER BY created_at ASC
         LIMIT 50
+        FOR UPDATE SKIP LOCKED
     """,
         (MAX_RETRIES,),
     )
@@ -364,7 +370,7 @@ def get_queue_status(conn, filters=None):
         params.append(int(filters["sale_id"]))
 
     if filters.get("type"):
-        where_clauses.append("q.type = %s")
+        where_clauses.append("LOWER(q.type) = LOWER(%s)")
         params.append(filters["type"])
 
     where = " AND ".join(where_clauses)
@@ -376,8 +382,12 @@ def get_queue_status(conn, filters=None):
         f"""
         SELECT q.id, q.sale_id, q.type, q.uuid_fiscal, q.status,
                q.retry_count, q.provisional_folio, q.error_message,
-               q.cancel_motive, q.created_at, q.stamped_at, q.external_id
+               q.cancel_motive, q.created_at, q.stamped_at, q.external_id,
+               c.name as customer_name, c.rfc,
+               s.subtotal, s.tax_total, s.total, s.payment_method
         FROM cfdi_queue q
+        LEFT JOIN sales s ON q.sale_id = s.id
+        LEFT JOIN customers c ON s.customer_id = c.id
         WHERE {where}
         ORDER BY q.created_at DESC
         LIMIT %s OFFSET %s
@@ -401,6 +411,12 @@ def get_queue_status(conn, filters=None):
                 "created_at": str(r[9]) if r[9] else None,
                 "stamped_at": str(r[10]) if r[10] else None,
                 "external_id": r[11],
+                "customer_name": r[12],
+                "rfc": r[13],
+                "subtotal": float(r[14]) if r[14] else 0,
+                "tax_total": float(r[15]) if r[15] else 0,
+                "total": float(r[16]) if r[16] else 0,
+                "payment_method": r[17],
             }
         )