feat: cashier/counter reports, service-order & remission flows, Rached migration utils

- Add "Mis cortes de caja" report for cashiers/counters with sales detail.
- Cash register history scoped to own cuts for non-admin roles; new /register/<id>/sales endpoint.
- Remove dashboard from cashier menu; add Reports to cashier/counter.
- Service orders: assign mechanic, budget field, invoice flag, counter/cashier can add items/remissions, convert to remission.
- Remission notes module (UI, CSS, courier, counter remissions).
- Customer hard-delete and vehicle/customer linkage in workshop.
- POS: always show search results, compact payment grid, credit validation, tier pricing (5%/10%), ticket with customer/folio.
- Inventory: CSV template with sku_secondary, alias import.
- Rached migration scripts and DB migrations.
- Version-bump cached JS/CSS query strings.

Excludes local Rached session tokens/captures (rached_*.json / rached_*.txt).

pos/blueprints/config_bp.py

@@ -1,6 +1,7 @@
 # /home/Autopartes/pos/blueprints/config_bp.py
 """Config blueprint: tenant configuration, branches, theming."""
 
+import json
 from flask import Blueprint, request, jsonify, g
 from middleware import require_auth, has_permission
 from tenant_db import get_tenant_conn
@@ -8,6 +9,109 @@ from tenant_db import get_tenant_conn
 config_bp = Blueprint('config', __name__, url_prefix='/pos/api/config')
 
 
+# Default permission set per role. Can be overridden per tenant via role_permissions config.
+_DEFAULT_ROLE_PERMISSIONS = {
+    'owner': [],  # owner bypasses permission checks
+    'admin': ['pos.sell', 'pos.discount', 'pos.cancel', 'pos.view_cost',
+              'inventory.view', 'inventory.create', 'inventory.edit', 'inventory.adjust', 'inventory.transfer',
+              'catalog.view', 'catalog.edit',
+              'customers.view', 'customers.create', 'customers.edit', 'customers.edit_credit',
+              'invoicing.view', 'invoicing.create',
+              'reports.view', 'reports.financial',
+              'config.view', 'config.edit', 'config.edit_prices',
+              'workshop.view', 'workshop.edit',
+              'fleet.view', 'fleet.create', 'fleet.edit', 'fleet.delete'],
+    'cashier': ['pos.sell', 'pos.discount', 'pos.cancel', 'pos.view', 'pos.remission',
+                'catalog.view',
+                'inventory.view', 'inventory.create',
+                'customers.view', 'customers.create',
+                'workshop.view', 'workshop.edit', 'workshop.add_items',
+                'invoicing.view', 'invoicing.create', 'invoicing.cancel'],
+    'counter': ['pos.remission', 'pos.view',
+                'catalog.view',
+                'inventory.view', 'inventory.create',
+                'customers.view', 'customers.create'],
+    'warehouse': ['inventory.view', 'inventory.create', 'inventory.edit',
+                  'inventory.adjust', 'inventory.transfer', 'catalog.view'],
+    'accountant': ['accounting.view', 'accounting.create',
+                   'invoicing.view', 'invoicing.create', 'invoicing.cancel',
+                   'reports.view', 'reports.financial',
+                   'customers.view',
+                   'fleet.view'],
+    'workshop': ['workshop.view', 'workshop.edit', 'workshop.add_items'],
+    'mechanic': ['workshop.view'],
+    'sales': ['pos.sell', 'pos.discount', 'pos.view', 'catalog.view',
+              'customers.view', 'customers.create'],
+}
+
+
+_AVAILABLE_PERMISSIONS = [
+    {'module': 'Punto de Venta', 'permissions': [
+        {'key': 'pos.sell', 'label': 'Realizar ventas'},
+        {'key': 'pos.view', 'label': 'Ver ventas/cotizaciones'},
+        {'key': 'pos.discount', 'label': 'Aplicar descuentos'},
+        {'key': 'pos.cancel', 'label': 'Cancelar ventas'},
+        {'key': 'pos.remission', 'label': 'Notas de remisión'},
+    ]},
+    {'module': 'Inventario', 'permissions': [
+        {'key': 'inventory.view', 'label': 'Ver inventario'},
+        {'key': 'inventory.create', 'label': 'Crear artículos'},
+        {'key': 'inventory.edit', 'label': 'Editar/eliminar artículos'},
+    ]},
+    {'module': 'Catálogo', 'permissions': [
+        {'key': 'catalog.view', 'label': 'Ver catálogo'},
+    ]},
+    {'module': 'Clientes', 'permissions': [
+        {'key': 'customers.view', 'label': 'Ver clientes'},
+        {'key': 'customers.create', 'label': 'Crear/editar clientes'},
+    ]},
+    {'module': 'Taller', 'permissions': [
+        {'key': 'workshop.view', 'label': 'Ver órdenes'},
+        {'key': 'workshop.edit', 'label': 'Crear/editar órdenes'},
+        {'key': 'workshop.add_items', 'label': 'Agregar artículos/mano de obra'},
+    ]},
+    {'module': 'Facturación', 'permissions': [
+        {'key': 'invoicing.view', 'label': 'Ver facturas'},
+        {'key': 'invoicing.create', 'label': 'Crear facturas'},
+        {'key': 'invoicing.cancel', 'label': 'Cancelar facturas'},
+    ]},
+    {'module': 'Configuración', 'permissions': [
+        {'key': 'config.edit', 'label': 'Editar configuración'},
+        {'key': 'config.edit_prices', 'label': 'Modificar precios'},
+    ]},
+    {'module': 'Contabilidad', 'permissions': [
+        {'key': 'accounting.view', 'label': 'Ver contabilidad'},
+        {'key': 'accounting.create', 'label': 'Crear movimientos contables'},
+    ]},
+    {'module': 'Reportes', 'permissions': [
+        {'key': 'reports.view', 'label': 'Ver reportes'},
+        {'key': 'reports.financial', 'label': 'Reportes financieros'},
+    ]},
+    {'module': 'Flotillas', 'permissions': [
+        {'key': 'fleet.view', 'label': 'Ver flotillas'},
+        {'key': 'fleet.create', 'label': 'Crear flotillas'},
+        {'key': 'fleet.edit', 'label': 'Editar flotillas'},
+        {'key': 'fleet.delete', 'label': 'Eliminar flotillas'},
+    ]},
+]
+
+
+def _get_role_permissions(conn, role):
+    """Return configured permissions for a role, falling back to defaults."""
+    cur = conn.cursor()
+    cur.execute("SELECT value FROM tenant_config WHERE key = 'role_permissions'")
+    row = cur.fetchone()
+    cur.close()
+    if row and row[0]:
+        try:
+            configured = json.loads(row[0])
+            if isinstance(configured, dict) and role in configured:
+                return list(configured.get(role, []))
+        except (ValueError, TypeError):
+            pass
+    return list(_DEFAULT_ROLE_PERMISSIONS.get(role, []))
+
+
 @config_bp.route('/branches', methods=['GET'])
 @require_auth()
 def list_branches():
@@ -250,7 +354,7 @@ def create_employee():
         nxt_name = PLANS[nxt]['name'] if nxt else 'Enterprise'
         return jsonify({'error': f'Plan limit reached ({limit} employees). Upgrade to {nxt_name}.'}), 403
 
-    valid_roles = ['admin', 'cashier', 'warehouse', 'accountant', 'workshop', 'mechanic']
+    valid_roles = ['admin', 'cashier', 'counter', 'warehouse', 'accountant', 'workshop', 'mechanic']
     if data['role'] not in valid_roles:
         return jsonify({'error': f'role must be one of: {", ".join(valid_roles)}'}), 400
 
@@ -265,33 +369,8 @@ def create_employee():
           data['role'], data.get('branch_id'), data.get('max_discount_pct', 0)))
     emp_id = cur.fetchone()[0]
 
-    # Set default permissions by role
-    role_permissions = {
-        'admin': ['pos.sell', 'pos.discount', 'pos.cancel', 'pos.view_cost',
-                   'inventory.view', 'inventory.create', 'inventory.edit', 'inventory.adjust', 'inventory.transfer',
-                   'catalog.view', 'catalog.edit',
-                   'customers.view', 'customers.create', 'customers.edit', 'customers.edit_credit',
-                   'invoicing.view', 'invoicing.create',
-                   'reports.view', 'reports.financial',
-                   'config.view', 'config.edit', 'config.edit_prices',
-                   'workshop.view', 'workshop.edit',
-                   'fleet.view', 'fleet.create', 'fleet.edit', 'fleet.delete'],
-        'cashier': ['pos.sell', 'pos.discount', 'pos.cancel',
-                     'catalog.view',
-                     'inventory.view', 'inventory.create',
-                     'customers.view', 'customers.create'],
-        'warehouse': ['inventory.view', 'inventory.create', 'inventory.edit',
-                       'inventory.adjust', 'inventory.transfer', 'catalog.view'],
-        'accountant': ['accounting.view', 'accounting.create',
-                        'invoicing.view', 'invoicing.create', 'invoicing.cancel',
-                        'reports.view', 'reports.financial',
-                        'customers.view',
-                        'fleet.view'],
-        'workshop': ['workshop.view', 'workshop.edit', 'workshop.add_items'],
-        'mechanic': ['workshop.view', 'workshop.edit', 'workshop.add_items'],
-    }
-
-    for perm in role_permissions.get(data['role'], []):
+    # Set default permissions by role (configurable per tenant)
+    for perm in _get_role_permissions(conn, data['role']):
         cur.execute(
             "INSERT INTO employee_permissions (employee_id, permission) VALUES (%s, %s) ON CONFLICT DO NOTHING",
             (emp_id, perm)
@@ -307,6 +386,61 @@ def create_employee():
     return jsonify({'id': emp_id, 'message': 'Employee created'}), 201
 
 
+@config_bp.route('/role-permissions', methods=['GET'])
+@require_auth()
+def get_role_permissions_config():
+    """Return the configured permissions for each role and the available permission list."""
+    conn = get_tenant_conn(g.tenant_id)
+    try:
+        configured = {}
+        for role in _DEFAULT_ROLE_PERMISSIONS:
+            configured[role] = _get_role_permissions(conn, role)
+        return jsonify({
+            'roles': configured,
+            'available': _AVAILABLE_PERMISSIONS,
+        })
+    finally:
+        conn.close()
+
+
+@config_bp.route('/role-permissions', methods=['PUT'])
+@require_auth('config.edit')
+def save_role_permissions_config():
+    """Save the permission mapping per role. Only owner/admin can edit."""
+    if g.employee_role not in ('owner', 'admin'):
+        return jsonify({'error': 'Solo administradores pueden editar permisos de roles'}), 403
+    data = request.get_json() or {}
+    if 'roles' not in data:
+        return jsonify({'error': 'roles object required'}), 400
+    for role, perms in data['roles'].items():
+        if role not in _DEFAULT_ROLE_PERMISSIONS:
+            return jsonify({'error': f'Invalid role: {role}'}), 400
+        if not isinstance(perms, list):
+            return jsonify({'error': f'permissions for {role} must be a list'}), 400
+    conn = get_tenant_conn(g.tenant_id)
+    cur = conn.cursor()
+    cur.execute("""
+        INSERT INTO tenant_config (key, value) VALUES ('role_permissions', %s)
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+    """, (json.dumps(data['roles']),))
+
+    # Apply the new permissions to existing employees of each affected role
+    for role, perms in data['roles'].items():
+        cur.execute("DELETE FROM employee_permissions WHERE employee_id IN (SELECT id FROM employees WHERE role = %s)", (role,))
+        cur.execute("SELECT id FROM employees WHERE role = %s", (role,))
+        emp_ids = [r[0] for r in cur.fetchall()]
+        for emp_id in emp_ids:
+            for perm in perms:
+                cur.execute(
+                    "INSERT INTO employee_permissions (employee_id, permission) VALUES (%s, %s) ON CONFLICT DO NOTHING",
+                    (emp_id, perm)
+                )
+
+    conn.commit()
+    cur.close(); conn.close()
+    return jsonify({'ok': True, 'updated_roles': list(data['roles'].keys())})
+
+
 @config_bp.route('/employees/<int:emp_id>', methods=['PUT'])
 @require_auth('config.edit')
 def update_employee(emp_id):
@@ -767,7 +901,7 @@ def update_whatsapp_config():
 
 
 @config_bp.route('/modules', methods=['GET'])
-@require_auth('config.view')
+@require_auth()
 def get_modules():
     """Get enabled modules for this tenant."""
     conn = get_tenant_conn(g.tenant_id)
@@ -820,6 +954,35 @@ def update_modules():
     }})
 
 
+@config_bp.route('/counter-remission', methods=['GET'])
+@require_auth()
+def get_counter_remission_config():
+    """Get counter remission note feature flag for this tenant."""
+    conn = get_tenant_conn(g.tenant_id)
+    cur = conn.cursor()
+    cur.execute("SELECT value FROM tenant_config WHERE key = 'counter_remission_enabled'")
+    row = cur.fetchone()
+    cur.close(); conn.close()
+    return jsonify({'enabled': str(row[0]).lower() == 'true' if row else False})
+
+
+@config_bp.route('/counter-remission', methods=['PUT'])
+@require_auth('config.edit')
+def update_counter_remission_config():
+    """Enable/disable counter remission notes for this tenant."""
+    data = request.get_json() or {}
+    enabled = 'true' if data.get('enabled') else 'false'
+    conn = get_tenant_conn(g.tenant_id)
+    cur = conn.cursor()
+    cur.execute("""
+        INSERT INTO tenant_config (key, value) VALUES (%s, %s)
+        ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+    """, ('counter_remission_enabled', enabled))
+    conn.commit()
+    cur.close(); conn.close()
+    return jsonify({'enabled': enabled == 'true'})
+
+
 @config_bp.route('/onboarding-status', methods=['GET'])
 @require_auth('pos.view')
 def get_onboarding_status():