chore(pos): bump SW cache to v13, skip /api/ caching, scope manifest to /pos/

Co-Authored-By: Claude <noreply@anthropic.com>

public/pos/manifest.json

@@ -2,8 +2,8 @@
   "name": "WFSALES POS",
   "short_name": "WFSALES POS",
   "description": "WFSALES POS — point of sale",
-  "start_url": "index.html",
-  "scope": ".",
+  "start_url": "/pos/index.html",
+  "scope": "/pos/",
   "display": "standalone",
   "orientation": "portrait",
   "background_color": "#ffffff",

public/pos/sw.js

@@ -1,5 +1,5 @@
 // Service worker — cache app shell, network-first for HTML + theme.js, cache-first for other static.
-const CACHE = "pos-v12";
+const CACHE = "pos-v13";
 const APP_SHELL = [
   './',
   './index.html',
@@ -7,7 +7,7 @@ const APP_SHELL = [
   './receipt.html',
   './history.html',
   './cashup.html',
-  './pb-config.js',
+  './pos-config.js',
   './pos-app.js',
   './theme.js',
   './manifest.json'
@@ -28,8 +28,9 @@ self.addEventListener('activate', e => {
 
 self.addEventListener('fetch', e => {
   const url = new URL(e.request.url);
-  // Never cache PocketBase API
-  if(url.hostname.includes('pocketbase') || url.hostname.includes('sslip.io')) return;
+  // Never cache API responses — only the static app shell. Serving a
+  // stale /catalog or, worse, a cached /checkout would be actively wrong.
+  if(url.pathname.startsWith('/api/')) return;
   // HTML navigations: always network-first so the user gets the latest page
   if(e.request.mode === 'navigate'){
     e.respondWith(