fix(customers): allow cashiers to view customers and use refreshed token

pos/blueprints/customers_bp.py

@@ -11,13 +11,13 @@ customers_bp = Blueprint('customers', __name__, url_prefix='/pos/api/customers')
 
 
 def _can_view_customers():
-    """Taller/counter employees need customer autocomplete even without customers.view."""
-    return g.employee_role == 'owner' or 'customers.view' in g.permissions or g.employee_role in ('workshop', 'mechanic', 'counter')
+    """Cashiers, counter and workshop employees need customer access for POS/service flows."""
+    return g.employee_role == 'owner' or 'customers.view' in g.permissions or g.employee_role in ('cashier', 'counter', 'workshop', 'mechanic')
 
 
 def _can_create_customer():
-    """Taller/counter employees can create customers on the fly from an order."""
-    return g.employee_role == 'owner' or 'customers.create' in g.permissions or g.employee_role in ('workshop', 'mechanic', 'counter')
+    """Cashiers, counter and workshop employees can create customers on the fly."""
+    return g.employee_role == 'owner' or 'customers.create' in g.permissions or g.employee_role in ('cashier', 'counter', 'workshop', 'mechanic')
 
 
 # ─── Customer CRUD ─────────────────────────────
@@ -126,8 +126,10 @@ def list_customers():
 
 
 @customers_bp.route('/<int:customer_id>', methods=['GET'])
-@require_auth('customers.view')
+@require_auth()
 def get_customer(customer_id):
+    if not _can_view_customers():
+        return jsonify({'error': 'Missing permissions: customers.view'}), 403
     """Get customer details with credit info, vehicle history, and recent purchases."""
     conn = get_tenant_conn(g.tenant_id)
     cur = conn.cursor()
@@ -198,8 +200,10 @@ def get_customer(customer_id):
 
 
 @customers_bp.route('/<int:customer_id>/purchases', methods=['GET'])
-@require_auth('customers.view')
+@require_auth()
 def get_customer_purchases(customer_id):
+    if not _can_view_customers():
+        return jsonify({'error': 'Missing permissions: customers.view'}), 403
     """Return full purchase history for a customer."""
     conn = get_tenant_conn(g.tenant_id)
     cur = conn.cursor()
@@ -379,8 +383,10 @@ def delete_customer(customer_id):
 
 
 @customers_bp.route('/<int:customer_id>/statement', methods=['GET'])
-@require_auth('customers.view')
+@require_auth()
 def customer_statement(customer_id):
+    if not _can_view_customers():
+        return jsonify({'error': 'Missing permissions: customers.view'}), 403
     """Account statement: sales (invoices), payments, running balance.
 
     Query params:
@@ -479,8 +485,10 @@ def customer_statement(customer_id):
 
 
 @customers_bp.route('/<int:customer_id>/vehicles', methods=['GET'])
-@require_auth('customers.view')
+@require_auth()
 def customer_vehicles(customer_id):
+    if not _can_view_customers():
+        return jsonify({'error': 'Missing permissions: customers.view'}), 403
     """Get customer's vehicle list with last purchases per vehicle.
 
     Vehicle info is stored as JSONB in customers.vehicle_info: