feat: proxy reverso POS desde puerto 5000 — accesible via Cloudflare

El servidor principal proxea /pos/* al POS en puerto 5001.
Elimina la necesidad de exponer puerto 5001 a internet.
Botones "Acceder al POS" en landing ahora usan /pos/login (mismo dominio).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/landing.html

@@ -500,11 +500,13 @@
       .catch(function(){});
   </script>
   <script>
-    // Fix POS links to point to port 5001
+    // Fix POS links — use nginx proxy path or direct IP
     document.querySelectorAll('a.pos-link').forEach(function(a) {
       a.addEventListener('click', function(e) {
         e.preventDefault();
-        window.location.href = location.protocol + '//' + location.hostname + ':5001/pos/login';
+        // Try same-origin /pos/ first (works if nginx proxies it)
+        // Fallback to direct server IP on port 5001
+        window.location.href = '/pos/login';
       });
     });
   </script>

dashboard/server.py

@@ -183,6 +183,32 @@ def search_vehicles(brand=None, model=None, year=None, engine_name=None, with_pa
 def index():
     return send_from_directory('.', 'landing.html')
 
+# ── POS Proxy — forward /pos/* to POS server on port 5001 ──
+@app.route('/pos/', defaults={'path': ''})
+@app.route('/pos/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE'])
+def pos_proxy(path):
+    import requests as req
+    target = f'http://127.0.0.1:5001/pos/{path}'
+    # Forward the request
+    try:
+        headers = {k: v for k, v in request.headers if k.lower() not in ('host', 'content-length')}
+        resp = req.request(
+            method=request.method,
+            url=target,
+            headers=headers,
+            params=request.args,
+            data=request.get_data(),
+            timeout=30
+        )
+        # Build response
+        from flask import Response
+        excluded = {'content-encoding', 'transfer-encoding', 'connection'}
+        resp_headers = [(k, v) for k, v in resp.raw.headers.items() if k.lower() not in excluded]
+        return Response(resp.content, status=resp.status_code, headers=resp_headers)
+    except Exception as e:
+        return jsonify({'error': f'POS server unavailable: {str(e)}'}), 502
+
+
 @app.route('/catalog')
 def public_catalog():
     return send_from_directory('.', 'catalog-public.html')