Mejoras de sesion: estabilizacion, IA, Nexus Yonke y marketplace B2B

- F0 blindaje: Redis/Celery, pg_hba sin trust LAN, secretos a env 600, backups, webhook auth, jobs muertos
- F1 caja: bugs POS, reembolsos al corte, apartados, CFDI, topes de descuento en cotizacion/apartado
- F2/F7 IA de catalogo: autocategorizacion, dedup de SKUs con embeddings, OCR de facturas, descripciones, claves SAT, limpieza de fitment
- F3 IA en el flujo: vision Yonke, preguntas MeLi, venta cruzada, anomalias, sinonimos, busqueda semantica (rerank/embeddings)
- F4/F8 escala y cartera: /metrics+Prometheus+Grafana, pool, score de credito, churn, metricas multi-tenant
- Nexus Yonke (M1-M6): modelo de datos 1-de-1, alta por donador, vitrina publica, MeLi usado, consignacion, garantia por dias, reportes, etiquetas
- Marketplace B2B entre yonkes (catalogo + pedidos cross-tenant)
- Seguridad: auth en /api/admin/* (35 endpoints), alertas por tenant
- Migraciones v4.27/v4.28; timers expire-demos y rollup-metrics

pos/templates/whatsapp.html

@@ -124,6 +124,93 @@
   </div>
 </div>
 
+
+<div style="max-width:720px;margin:16px auto;padding:16px;border:1px solid var(--color-border);border-radius:12px;">
+  <h3 style="margin:0 0 4px;">WA CRM — Meta Cloud API (oficial)</h3>
+  <p style="margin:0 0 12px;font-size:var(--text-caption);color:var(--color-text-muted);">
+    Un número por refaccionaria. Credenciales de Meta Business (phone number ID + token permanente).
+    El proveedor Baileys queda como respaldo.</p>
+  <div style="display:grid;grid-template-columns:1fr 1fr;gap:10px;">
+    <div>
+      <label style="font-size:var(--text-caption);">Proveedor</label>
+      <select id="waProvider" class="form-input">
+        <option value="baileys">Baileys (bridge actual)</option>
+        <option value="meta">Meta Cloud API (WA CRM)</option>
+      </select>
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">Phone Number ID</label>
+      <input id="waPnid" class="form-input" placeholder="ej. 123456789012345" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">Access Token</label>
+      <input id="waToken" type="password" class="form-input" placeholder="(dejar vacío = sin cambio)" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">App Secret</label>
+      <input id="waSecret" type="password" class="form-input" placeholder="(dejar vacío = sin cambio)" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">Verify Token (webhook)</label>
+      <input id="waVerify" class="form-input" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">WA CRM — API base</label>
+      <input id="waApiBase" class="form-input" placeholder="http://192.168.10.91:3010" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">WA CRM — API key (wacrm_live_…)</label>
+      <input id="waApiKey" type="password" class="form-input" placeholder="(dejar vacío = sin cambio)" />
+    </div>
+    <div>
+      <label style="font-size:var(--text-caption);">URL pública del POS (para imágenes)</label>
+      <input id="waPublicBase" class="form-input" placeholder="https://<subdominio>.nexusautoparts.com.mx" />
+    </div>
+    <div style="display:flex;align-items:flex-end;">
+      <button class="btn btn--primary" onclick="saveWaMeta()" style="width:100%;">Guardar WA CRM</button>
+    </div>
+  </div>
+  <div id="waMetaStatus" style="margin-top:8px;font-size:var(--text-caption);color:var(--color-text-muted);"></div>
+</div>
+<script>
+(async function loadWaMeta() {
+  try {
+    const t = localStorage.getItem('pos_token');
+    const r = await fetch('/pos/api/config/whatsapp', { headers: { 'Authorization': 'Bearer ' + t } });
+    if (!r.ok) return;
+    const d = await r.json();
+    document.getElementById('waProvider').value = d.provider || 'baileys';
+    document.getElementById('waPnid').value = d.phone_number_id || '';
+    document.getElementById('waVerify').value = d.verify_token || '';
+    document.getElementById('waApiBase').value = d.api_base || '';
+    document.getElementById('waPublicBase').value = d.public_base || '';
+    document.getElementById('waMetaStatus').textContent =
+      (d.has_access_token ? '✓ Token guardado. ' : 'Sin token. ') +
+      (d.has_app_secret ? '✓ App secret guardado.' : 'Sin app secret (webhook sin validación HMAC).');
+  } catch (e) { /* noop */ }
+})();
+async function saveWaMeta() {
+  const t = localStorage.getItem('pos_token');
+  const body = {
+    provider: document.getElementById('waProvider').value,
+    phone_number_id: document.getElementById('waPnid').value.trim(),
+    verify_token: document.getElementById('waVerify').value.trim(),
+    api_base: document.getElementById('waApiBase').value.trim(),
+    api_key: document.getElementById('waApiKey').value.trim(),
+    public_base: document.getElementById('waPublicBase').value.trim(),
+    access_token: document.getElementById('waToken').value.trim(),
+    app_secret: document.getElementById('waSecret').value.trim(),
+  };
+  const r = await fetch('/pos/api/config/whatsapp', {
+    method: 'PUT', headers: { 'Authorization': 'Bearer ' + t, 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  const el = document.getElementById('waMetaStatus');
+  if (r.ok) { el.textContent = '✓ Configuración guardada'; el.style.color = 'var(--color-success)'; }
+  else { el.textContent = 'Error guardando'; el.style.color = 'var(--color-error)'; }
+}
+</script>
+
 <!-- Theme engine -->
 <script>
 function posSetTheme(t){document.documentElement.setAttribute('data-theme',t);localStorage.setItem('pos_theme',t);}
@@ -132,7 +219,7 @@ function posLogout(){localStorage.removeItem('pos_token');window.location.href='
 
 <!-- Sidebar -->
 <script src="/pos/static/js/i18n.js?v=39" defer></script>
-<script src="/pos/static/js/app-init.js?v=8" defer></script>
+<script src="/pos/static/js/app-init.js?v=9" defer></script>
 <script src="/pos/static/js/splash-loader.js?v=33" defer></script>
 <script src="/pos/static/js/whatsapp2.js?v=33" defer></script>
 <script src="/pos/static/js/pos-utils.js?v=33" defer></script>