- Cambia default global de IsAuthenticated a AllowAny en settings/base.py - ProductView: AllowAny para GET, IsAuthenticated para POST/PUT/DELETE - CatalogueImageViewSet: AllowAny para reads, IsAuthenticated+Admin para writes - PaymentMethodView: AllowAny (público) - SaleView, CatalogSaleView, SaleSummary, CatalogSaleSummary: IsAuthenticated - CustomerView: IsAuthenticated