fix(audit): corrige errores criticos y mayores, mejora UX/accesibilidad y optimiza rendimiento

- Arregla @require_auth, permisos, race conditions, locks de caja/stock
- Elimina N+1 en layaway, flotilla, dashboard y global_invoice
- Asegura folios atomicos para CFDI, ordenes de servicio y polizas
- Protege client_secret de MercadoLibre en backend
- Conecta botones/filtros de config, customers, accounting e invoicing
- Mejora accesibilidad (labels/aria-label) y estados de carga/vacio
- Limpia accounting.js obsoleto y consolida accounting.v9.js
- Actualiza cache busting a v32 y Service Worker a v32
- Documenta todo en docs/AUDIT_Y_MEJORAS_2026-06-15.md

Tests: 35 passed

pos/templates/fleet.html

@@ -8,7 +8,7 @@
   <link rel="stylesheet" href="/pos/static/css/chat.css" />
   <link rel="stylesheet" href="/pos/static/css/tokens.css" />
   <link rel="stylesheet" href="/pos/static/css/common.css" />
-  <link rel="stylesheet" href="/pos/static/css/pos-ui.css?v=2" />
+  <link rel="stylesheet" href="/pos/static/css/pos-ui.css?v=32" />
   <link rel="stylesheet" href="/pos/static/css/sidebar.css" />
   <link rel="stylesheet" href="/pos/static/css/pos-glass.css" />
   <link rel="manifest" href="/pos/static/pwa/manifest.json" />
@@ -305,8 +305,8 @@
 
 <script src="/pos/static/js/i18n.js" defer></script>
 <script src="/pos/static/js/app-init.js" defer></script>
-<script src="/pos/static/js/splash-loader.js?v=1" defer></script>
-<script src="/pos/static/js/pos-utils.js?v=2" defer></script>
+<script src="/pos/static/js/splash-loader.js?v=32" defer></script>
+<script src="/pos/static/js/pos-utils.js?v=32" defer></script>
   <script src="/pos/static/js/sidebar.js" defer></script>
 <script src="/pos/static/js/fleet.js" defer></script>
 <script src="/pos/static/js/offline-banner.js" defer></script>