feat: catálogo público sin autenticación, solo confirmar compra requiere auth

- Cambia default global de IsAuthenticated a AllowAny en settings/base.py
- ProductView: AllowAny para GET, IsAuthenticated para POST/PUT/DELETE
- CatalogueImageViewSet: AllowAny para reads, IsAuthenticated+Admin para writes
- PaymentMethodView: AllowAny (público)
- SaleView, CatalogSaleView, SaleSummary, CatalogSaleSummary: IsAuthenticated
- CustomerView: IsAuthenticated

tienda_ilusion/don_confiao/api/catalogue_images.py

@@ -1,5 +1,5 @@
 from rest_framework import viewsets
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import AllowAny, IsAuthenticated
 
 from ..image_service import resize_catalogue_image
 from ..models.catalogue_images import CatalogueImage
@@ -14,7 +14,7 @@ class CatalogueImageViewSet(viewsets.ModelViewSet):
     def get_permissions(self):
         if self.action in ("create", "update", "partial_update", "destroy"):
             return [IsAuthenticated(), IsAdministrator()]
-        return [IsAuthenticated()]
+        return [AllowAny()]
 
     def perform_create(self, serializer):
         instance = serializer.save()

tienda_ilusion/don_confiao/api/customers.py

@@ -13,6 +13,7 @@ from ..services.tryton.client import get_tryton_client
 class CustomerView(viewsets.ModelViewSet):
     queryset = Customer.objects.all()
     serializer_class = CustomerSerializer
+    permission_classes = [IsAuthenticated]
 
 
 class CustomersFromTrytonView(APIView):

tienda_ilusion/don_confiao/api/payments.py

@@ -3,7 +3,7 @@ from rest_framework.views import APIView
 from rest_framework.response import Response
 from rest_framework.status import HTTP_400_BAD_REQUEST
 from rest_framework.pagination import PageNumberPagination
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import AllowAny, IsAuthenticated
 from decimal import Decimal
 
 from ..models.sales import Sale
@@ -87,6 +87,8 @@ class ReconciliateJarModelView(viewsets.ModelViewSet):
 
 
 class PaymentMethodView(APIView):
+    permission_classes = [AllowAny]
+
     def get(self, request):
         serializer = PaymentMethodSerializer(PaymentMethods.choices, many=True)
         return Response(serializer.data)

tienda_ilusion/don_confiao/api/products.py

@@ -1,7 +1,7 @@
 from rest_framework import viewsets
 from rest_framework.views import APIView
 from rest_framework.response import Response
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import AllowAny, IsAuthenticated
 
 from ..models.products import Product
 from ..serializers import ProductSerializer
@@ -14,6 +14,11 @@ class ProductView(viewsets.ModelViewSet):
     queryset = Product.objects.all()
     serializer_class = ProductSerializer
 
+    def get_permissions(self):
+        if self.action in ("list", "retrieve"):
+            return [AllowAny()]
+        return [IsAuthenticated()]
+
     def get_queryset(self):
         """
         Filters products by active status for list operations.

tienda_ilusion/don_confiao/api/sales.py

@@ -23,6 +23,7 @@ from ..views import sales_to_tryton_csv
 class SaleView(viewsets.ModelViewSet):
     queryset = Sale.objects.all()
     serializer_class = SaleSerializer
+    permission_classes = [IsAuthenticated]
 
     def create(self, request):
         data = request.data
@@ -58,9 +59,12 @@ class SaleView(viewsets.ModelViewSet):
 class CatalogSaleView(viewsets.ModelViewSet):
     queryset = CatalogSale.objects.all()
     serializer_class = CatalogSaleSerializer
+    permission_classes = [IsAuthenticated]
 
 
 class SaleSummary(APIView):
+    permission_classes = [IsAuthenticated]
+
     def get(self, request, id):
         sale = Sale.objects.get(pk=id)
         serializer = SaleSummarySerializer(sale)
@@ -68,6 +72,8 @@ class SaleSummary(APIView):
 
 
 class CatalogSaleSummary(APIView):
+    permission_classes = [IsAuthenticated]
+
     def get(self, request, id):
         catalog_sale = CatalogSale.objects.get(pk=id)
         serializer = CatalogSaleSummarySerializer(catalog_sale)