feat: proxy reverso POS desde puerto 5000 — accesible via Cloudflare

El servidor principal proxea /pos/* al POS en puerto 5001.
Elimina la necesidad de exponer puerto 5001 a internet.
Botones "Acceder al POS" en landing ahora usan /pos/login (mismo dominio).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/landing.html

@@ -500,11 +500,13 @@
       .catch(function(){});
   </script>
   <script>
-    // Fix POS links to point to port 5001
+    // Fix POS links — use nginx proxy path or direct IP
     document.querySelectorAll('a.pos-link').forEach(function(a) {
       a.addEventListener('click', function(e) {
         e.preventDefault();
-        window.location.href = location.protocol + '//' + location.hostname + ':5001/pos/login';
+        // Try same-origin /pos/ first (works if nginx proxies it)
+        // Fallback to direct server IP on port 5001
+        window.location.href = '/pos/login';
       });
     });
   </script>