fix(customers): allow cashiers to view customers and use refreshed token

pos/static/js/customers.js

@@ -5,7 +5,6 @@
  * Wired to the design-system HTML (customers.html).
  */
 const Customers = (() => {
-    let token = localStorage.getItem('pos_token') || '';
     let currentPage = 1;
     let totalPages = 1;
     let currentCustomer = null;
@@ -16,6 +15,10 @@ const Customers = (() => {
     const userPerms = user.permissions || [];
     const canDeleteCustomer = userRole === 'owner' || userRole === 'admin' || userPerms.includes('customers.delete');
 
+    function getToken() {
+        return localStorage.getItem('pos_token') || '';
+    }
+
     const fmt = (n) => '$' + parseFloat(n || 0).toLocaleString('es-MX', {
         minimumFractionDigits: 2, maximumFractionDigits: 2
     });
@@ -28,7 +31,7 @@ const Customers = (() => {
     };
 
     function headers() {
-        return { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token };
+        return { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + getToken() };
     }
 
     async function api(url, options = {}) {
@@ -733,7 +736,7 @@ const Customers = (() => {
     // ─── Init ────────────────────────────
     function init() {
         // Auth check
-        if (!token) {
+        if (!getToken()) {
             window.location.href = '/pos/login';
             return;
         }