fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/services/tenant_manager.py

@@ -247,7 +247,8 @@ def provision_tenant(name, rfc=None, owner_name="Admin", owner_email=None, owner
             'accounting.view', 'accounting.create', 'accounting.close',
             'invoicing.view', 'invoicing.create', 'invoicing.cancel',
             'reports.view', 'reports.financial',
-            'config.view', 'config.edit', 'config.edit_prices'
+            'config.view', 'config.edit', 'config.edit_prices',
+            'fleet.view', 'fleet.create', 'fleet.edit', 'fleet.delete'
         ]
         tenant_cur.executemany(
             "INSERT INTO employee_permissions (employee_id, permission) VALUES (%s, %s)",