fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/static/js/pos-utils.js

@@ -160,7 +160,15 @@
         delete el.dataset.originalContent;
     };
 
-    // ── Empty state helper ────────────────────────────────────────
+    // ── Loading / Empty state helpers ────────────────────────────────────────
+    window.renderLoadingState = function(opts) {
+        opts = opts || {};
+        var message = opts.message || 'Cargando...';
+        return '<div class="empty-state empty-state--loading" role="status" aria-live="polite">' +
+            '<div class="empty-state__icon"><svg class="empty-state__spinner" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-6.219-8.56"/></svg></div>' +
+            '<div class="empty-state__title">' + message + '</div>' +
+            '</div>';
+    };
     window.renderEmptyState = function(opts) {
         opts = opts || {};
         var icon = opts.icon || '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="2" ry="2"/><line x1="9" y1="9" x2="15" y2="15"/><line x1="15" y1="9" x2="9" y2="15"/></svg>';