fix(auth): restringe workshop/mecanico solo por servidor y cookie

- Elimina el script inline que redirigia a todos los usuarios.
- auth_bp.py: la respuesta de login ahora setea cookie pos_role.
- app.py: before_request redirige a /pos/workshop solo cuando la cookie
  indica rol workshop/mechanic (no depende de JS cacheado).
- login.js/login.min.js/app-init.js: sincronizan/limpian la cookie pos_role
  junto con el token en login y logout.

Tests: 35 passed

pos/blueprints/auth_bp.py

@@ -5,7 +5,7 @@ import jwt
 import bcrypt
 import time
 from datetime import datetime, timezone, timedelta
-from flask import Blueprint, request, jsonify, g
+from flask import Blueprint, request, jsonify, g, make_response
 from config import JWT_SECRET, JWT_ACCESS_EXPIRES, PIN_MAX_ATTEMPTS_PER_MINUTE, PIN_LOCKOUT_THRESHOLD, PIN_LOCKOUT_MINUTES
 from tenant_db import get_tenant_conn, get_master_conn
 
@@ -157,11 +157,17 @@ def login_pin():
     }
     token = jwt.encode(payload, JWT_SECRET, algorithm='HS256')
 
-    return jsonify({
+    response = make_response(jsonify({
         'token': token,
         'employee': matched_employee,
         'permissions': permissions
-    })
+    }))
+    # Cookie used by server-side route guards; JS can also read it for quick checks.
+    response.set_cookie(
+        'pos_role', matched_employee['role'],
+        path='/pos', samesite='Lax', httponly=False
+    )
+    return response
 
 
 @auth_bp.route('/employees/<int:tenant_id>', methods=['GET'])