feat(pos): replace hardcoded PB superuser creds with POS_API_KEY config

Co-Authored-By: Claude <noreply@anthropic.com>

public/pos/cashup.html

@@ -241,7 +241,7 @@ button:focus-visible,input:focus-visible,select:focus-visible{outline:0;box-shad
   </button>
 </div>
 
-<script src="pb-config.js"></script>
+<script src="pos-config.js"></script>
 <script src="theme.js"></script>
 <script>
 (function(){

public/pos/history.html

@@ -158,7 +158,7 @@ button:focus-visible,input:focus-visible,select:focus-visible{outline:0;box-shad
   <div class="empty"><h3>Loading…</h3></div>
 </main>
 
-<script src="pb-config.js"></script>
+<script src="pos-config.js"></script>
 <script src="theme.js"></script>
 <script>
 (function(){

public/pos/index.html

@@ -125,7 +125,7 @@ h1{font-size:28px;font-weight:700;letter-spacing:-.02em;line-height:1.15;margin:
 
 <p class="foot"><b id="prodCount">—</b> products · cache <span id="cacheState">pending</span></p>
 
-<script src="pb-config.js"></script>
+<script src="pos-config.js"></script>
 <script src="theme.js"></script>
 <script>
 (async function(){

public/pos/pos-config.js

@@ -0,0 +1,28 @@
+// POS config — no PocketBase credentials here. The device only knows
+// its own API key for this app's /api/v1/pos/* routes; PocketBase
+// auth happens server-side (see src/lib/server/pocketbase-admin.ts).
+window.POS_CONFIG = (function () {
+  const STORAGE_KEY = "pos.apiKey";
+  let apiKey = localStorage.getItem(STORAGE_KEY) || "";
+  if (!apiKey) {
+    apiKey = window.prompt("Enter this till's POS API key (ask the office for it):") || "";
+    if (apiKey) localStorage.setItem(STORAGE_KEY, apiKey);
+  }
+  return { apiBase: "/api/v1/pos", apiKey };
+})();
+
+window.posFetch = async function (path, opts = {}) {
+  const cfg = window.POS_CONFIG;
+  const headers = Object.assign(
+    { Authorization: "Bearer " + cfg.apiKey },
+    opts.headers || {},
+  );
+  return fetch(cfg.apiBase + path, Object.assign({}, opts, { headers }));
+};
+
+// A wrong key is worth surfacing loudly — otherwise every screen just
+// silently shows "Offline" and staff assume the network is down.
+window.posClearApiKey = function () {
+  localStorage.removeItem("pos.apiKey");
+  location.reload();
+};

public/pos/pos.html

@@ -385,7 +385,7 @@ input{font:inherit;color:inherit}
   </div>
 </div>
 
-<script src="pb-config.js"></script>
+<script src="pos-config.js"></script>
 <script src="theme.js"></script>
 <script src="pos-app.js"></script>
 <script>if("serviceWorker" in navigator){navigator.serviceWorker.register("sw.js").catch(function(){});}</script>

public/pos/receipt.html

@@ -310,7 +310,7 @@ input,select{font:inherit;color:inherit}
 
 </div>
 
-<script src="pb-config.js"></script>
+<script src="pos-config.js"></script>
 <script src="theme.js"></script>
 <script>
 (function(){