feat: cashier/counter reports, service-order & remission flows, Rached migration utils

- Add "Mis cortes de caja" report for cashiers/counters with sales detail.
- Cash register history scoped to own cuts for non-admin roles; new /register/<id>/sales endpoint.
- Remove dashboard from cashier menu; add Reports to cashier/counter.
- Service orders: assign mechanic, budget field, invoice flag, counter/cashier can add items/remissions, convert to remission.
- Remission notes module (UI, CSS, courier, counter remissions).
- Customer hard-delete and vehicle/customer linkage in workshop.
- POS: always show search results, compact payment grid, credit validation, tier pricing (5%/10%), ticket with customer/folio.
- Inventory: CSV template with sku_secondary, alias import.
- Rached migration scripts and DB migrations.
- Version-bump cached JS/CSS query strings.

Excludes local Rached session tokens/captures (rached_*.json / rached_*.txt).

pos/blueprints/customers_bp.py

@@ -10,10 +10,20 @@ from services.audit import log_action
 customers_bp = Blueprint('customers', __name__, url_prefix='/pos/api/customers')
 
 
+def _can_view_customers():
+    """Taller/counter employees need customer autocomplete even without customers.view."""
+    return g.employee_role == 'owner' or 'customers.view' in g.permissions or g.employee_role in ('workshop', 'mechanic', 'counter')
+
+
+def _can_create_customer():
+    """Taller/counter employees can create customers on the fly from an order."""
+    return g.employee_role == 'owner' or 'customers.create' in g.permissions or g.employee_role in ('workshop', 'mechanic', 'counter')
+
+
 # ─── Customer CRUD ─────────────────────────────
 
 @customers_bp.route('', methods=['GET'])
-@require_auth('customers.view')
+@require_auth()
 def list_customers():
     """Search/list customers. Supports autocomplete-style search by name, RFC, phone.
 
@@ -23,6 +33,8 @@ def list_customers():
         per_page: items per page (default 50, max 200)
         branch_id: filter by branch (default: current user's branch)
     """
+    if not _can_view_customers():
+        return jsonify({'error': 'Missing permissions: customers.view'}), 403
     conn = get_tenant_conn(g.tenant_id)
     cur = conn.cursor()
 
@@ -219,13 +231,15 @@ def get_customer_purchases(customer_id):
 
 
 @customers_bp.route('', methods=['POST'])
-@require_auth('customers.create')
+@require_auth()
 def create_customer():
     """Create a new customer.
 
     Body: {name, rfc, razon_social, regimen_fiscal, uso_cfdi, cp, email,
            phone, address, price_tier, credit_limit, vehicle_info}
     """
+    if not _can_create_customer():
+        return jsonify({'error': 'Missing permissions: customers.create'}), 403
     data = request.get_json() or {}
     if not data.get('name'):
         return jsonify({'error': 'name is required'}), 400