fix(roles): restringe usuarios Taller y Mecanico a solo la seccion de Taller y oculta precios

- sidebar.js: itemAllowed incluye mechanic junto a workshop -> solo muestra Taller
- app-init.js: redirige a /pos/workshop si el rol es workshop/mechanic
- config_bp.py: remueve customers.view y fleet.view de los permisos por defecto de workshop/mechanic
- workshop.js: hidePrices ahora tambien aplica para mechanic; oculta columnas/inputs de precio
- app-init.js/config.js: agrega etiquetas de rol para workshop y mechanic
- workshop.html: marca columnas de precio con price-col y oculta input catRate

Tests: 35 passed

pos/static/js/app-init.js

@@ -43,7 +43,8 @@
     var _t = typeof window.t === 'function' ? window.t : function(k) { return k; };
     var roleLabels = {
         'owner': _t('role_owner'), 'admin': _t('role_admin'), 'cashier': _t('role_cashier'),
-        'warehouse': _t('role_warehouse'), 'accountant': _t('role_accountant')
+        'warehouse': _t('role_warehouse'), 'accountant': _t('role_accountant'),
+        'workshop': 'Taller', 'mechanic': 'Mecanico'
     };
     var roleLabel = roleLabels[role] || role;
     var initials = name.split(' ').map(function(p) { return p[0]; }).join('').toUpperCase().substring(0, 2);
@@ -180,6 +181,12 @@
         permissions: payload.permissions || []
     };
 
+    // ─── Restrict workshop/mechanic users to the workshop view only ───
+    if ((role === 'workshop' || role === 'mechanic') && window.location.pathname !== '/pos/workshop') {
+        window.location.replace('/pos/workshop');
+        return;
+    }
+
     // ─── Preload enabled modules for sidebar filtering ───
     try {
         fetch('/pos/api/config/modules', {

pos/static/js/sidebar.js

@@ -41,7 +41,7 @@ window.renderSidebar = function(modulesOverride) {
     // only the sections relevant to their job.
     function itemAllowed(id) {
         if (role === 'owner' || role === 'admin') return true;
-        if (role === 'workshop') {
+        if (role === 'workshop' || role === 'mechanic') {
             return id === 'workshop';
         }
         if (role === 'cashier') {

pos/static/js/workshop.js

@@ -22,7 +22,7 @@ var Workshop = (function() {
 
     var user = window.POS_USER || {};
     var role = (user.role || '').toLowerCase();
-    var hidePrices = role === 'workshop';
+    var hidePrices = role === 'workshop' || role === 'mechanic';
     var perms = user.permissions || [];
     var canEdit = role === 'owner' || role === 'admin' || perms.indexOf('workshop.edit') !== -1;
     var canSell = role === 'owner' || role === 'admin' || perms.indexOf('pos.sell') !== -1;
@@ -652,15 +652,15 @@ var Workshop = (function() {
     function renderCatalog() {
         var body = document.getElementById('catalogBody');
         if (!catalog.length) {
-            body.innerHTML = '<tr><td colspan="5" style="text-align:center;">Sin conceptos</td></tr>';
+            body.innerHTML = '<tr><td colspan="' + (hidePrices ? 3 : 5) + '" style="text-align:center;">Sin conceptos</td></tr>';
             return;
         }
         body.innerHTML = catalog.map(function(c) {
             return '<tr>' +
                 '<td>' + esc(c.name) + (c.description ? '<br><small>' + esc(c.description) + '</small>' : '') + '</td>' +
                 '<td>' + fmt(c.suggested_hours) + '</td>' +
-                '<td>' + fmtMoney(c.suggested_rate) + '</td>' +
-                '<td>' + fmtMoney(c.suggested_hours * c.suggested_rate) + '</td>' +
+                (hidePrices ? '' : '<td class="price-col">' + fmtMoney(c.suggested_rate) + '</td>' +
+                '<td class="price-col">' + fmtMoney(c.suggested_hours * c.suggested_rate) + '</td>') +
                 '<td><button class="btn btn--sm btn--ghost" onclick="Workshop.deleteCatalogItem(' + c.id + ')">Desactivar</button></td>' +
                 '</tr>';
         }).join('');