fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/services/global_invoice.py

@@ -58,19 +58,18 @@ def get_eligible_sales(conn, year, month, branch_id=None, max_total=2000):
         cur.close()
         return []
 
-    # Load sale details with items
-    sales = []
-    for sale_id in sale_ids:
-        cur.execute("""
-            SELECT id, branch_id, customer_id, employee_id, sale_type,
-                   payment_method, subtotal, discount_total, tax_total, total,
-                   metodo_pago_sat, forma_pago_sat, status, created_at
-            FROM sales WHERE id = %s
-        """, (sale_id,))
-        row = cur.fetchone()
-        if not row:
-            continue
+    # Load sale details with items in two bulk queries (O(1) round-trips)
+    cur.execute("""
+        SELECT id, branch_id, customer_id, employee_id, sale_type,
+               payment_method, subtotal, discount_total, tax_total, total,
+               metodo_pago_sat, forma_pago_sat, status, created_at
+        FROM sales
+        WHERE id = ANY(%s)
+        ORDER BY created_at ASC
+    """, (sale_ids,))
 
+    sales = {}
+    for row in cur.fetchall():
         sale = {
             'id': row[0], 'branch_id': row[1], 'customer_id': row[2],
             'employee_id': row[3], 'sale_type': row[4],
@@ -85,33 +84,37 @@ def get_eligible_sales(conn, year, month, branch_id=None, max_total=2000):
             'created_at': str(row[13]),
             'items': [],
         }
+        sales[row[0]] = sale
 
-        cur.execute("""
-            SELECT id, inventory_id, part_number, name, quantity, unit_price,
-                   unit_cost, discount_pct, discount_amount, tax_rate, tax_amount,
-                   subtotal, clave_prod_serv, clave_unidad
-            FROM sale_items WHERE sale_id = %s ORDER BY id
-        """, (sale_id,))
+    cur.execute("""
+        SELECT id, sale_id, inventory_id, part_number, name, quantity, unit_price,
+               unit_cost, discount_pct, discount_amount, tax_rate, tax_amount,
+               subtotal, clave_prod_serv, clave_unidad
+        FROM sale_items
+        WHERE sale_id = ANY(%s)
+        ORDER BY sale_id, id
+    """, (sale_ids,))
 
-        for r in cur.fetchall():
-            sale['items'].append({
-                'id': r[0], 'inventory_id': r[1], 'part_number': r[2],
-                'name': r[3], 'quantity': r[4],
-                'unit_price': float(r[5]) if r[5] else 0,
-                'unit_cost': float(r[6]) if r[6] else 0,
-                'discount_pct': float(r[7]) if r[7] else 0,
-                'discount_amount': float(r[8]) if r[8] else 0,
-                'tax_rate': float(r[9]) if r[9] else 0.16,
-                'tax_amount': float(r[10]) if r[10] else 0,
-                'subtotal': float(r[11]) if r[11] else 0,
-                'clave_prod_serv': r[12] or '25174800',
-                'clave_unidad': r[13] or 'H87',
-            })
-
-        sales.append(sale)
+    for r in cur.fetchall():
+        sale = sales.get(r[1])
+        if not sale:
+            continue
+        sale['items'].append({
+            'id': r[0], 'inventory_id': r[2], 'part_number': r[3],
+            'name': r[4], 'quantity': r[5],
+            'unit_price': float(r[6]) if r[6] else 0,
+            'unit_cost': float(r[7]) if r[7] else 0,
+            'discount_pct': float(r[8]) if r[8] else 0,
+            'discount_amount': float(r[9]) if r[9] else 0,
+            'tax_rate': float(r[10]) if r[10] else 0.16,
+            'tax_amount': float(r[11]) if r[11] else 0,
+            'subtotal': float(r[12]) if r[12] else 0,
+            'clave_prod_serv': r[13] or '25174800',
+            'clave_unidad': r[14] or 'H87',
+        })
 
     cur.close()
-    return sales
+    return list(sales.values())
 
 
 def generate_global_invoice(conn, tenant_config, year, month, branch_id=None,