fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/static/js/marketplace_external.js

@@ -64,7 +64,7 @@
         }
     }
 
-    window.startOAuth = function() {
+    window.startOAuth = async function() {
         var clientId = document.getElementById('cfgClientId').value.trim();
         var clientSecret = document.getElementById('cfgClientSecret').value.trim();
         var category = document.getElementById('cfgCategory').value.trim();
@@ -75,15 +75,34 @@
             return;
         }
 
-        // Save config locally for the callback
-        localStorage.setItem('meli_client_id', clientId);
-        localStorage.setItem('meli_client_secret', clientSecret);
+        // Purge any previously stored secret from older versions
+        localStorage.removeItem('meli_client_secret');
+        localStorage.removeItem('meli_client_id');
         localStorage.setItem('meli_category', category);
         localStorage.setItem('meli_shipping', shipping);
 
-        var redirectUri = window.location.origin + '/pos/marketplace-external/callback';
-        var authUrl = 'https://auth.mercadolibre.com.mx/authorization?response_type=code&client_id=' + encodeURIComponent(clientId) + '&redirect_uri=' + encodeURIComponent(redirectUri) + '&scope=read+write+offline_access';
-        window.location.href = authUrl;
+        try {
+            var res = await fetch(API + '/connect/init', {
+                method: 'POST',
+                headers: headers(),
+                body: JSON.stringify({
+                    client_id: clientId,
+                    client_secret: clientSecret,
+                    category: category,
+                    shipping: shipping
+                })
+            });
+            var data = await res.json();
+            if (!res.ok) {
+                alert('Error iniciando conexión: ' + (data.error || 'Unknown'));
+                return;
+            }
+            if (data.auth_url) {
+                window.location.href = data.auth_url;
+            }
+        } catch (e) {
+            alert('Error: ' + e.message);
+        }
     };
 
     window.disconnectMeli = async function() {
@@ -363,8 +382,6 @@
     var authCode = urlParams.get('code');
     if (authCode && window.location.pathname.includes('marketplace-external')) {
         (async function() {
-            var clientId = localStorage.getItem('meli_client_id');
-            var clientSecret = localStorage.getItem('meli_client_secret');
             var redirectUri = window.location.origin + '/pos/marketplace-external/callback';
             try {
                 var res = await fetch(API + '/connect', {
@@ -372,8 +389,6 @@
                     headers: headers(),
                     body: JSON.stringify({
                         code: authCode,
-                        client_id: clientId,
-                        client_secret: clientSecret,
                         redirect_uri: redirectUri,
                     })
                 });