fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/static/pwa/sw.js

@@ -1,12 +1,13 @@
 // /home/Autopartes/pos/static/pwa/sw.js
-// Nexus POS — Service Worker v17
+// Nexus POS — Service Worker
 // Self-contained vanilla JS. No external imports.
 //
-// Bump CACHE_NAME whenever static assets change significantly.
+// Bump VERSION whenever static assets change significantly.
 // The fetch handler normalizes static asset URLs (strips ?v= query strings)
 // so templates can use cache-busting query params freely.
 
-const CACHE_NAME = 'nexus-pos-v26';
+const VERSION = 32;
+const CACHE_NAME = 'nexus-pos-v' + VERSION;
 
 const APP_SHELL = [
   '/pos/static/css/tokens.css',