fix(portal) : allow admin+client users to access both views and add admin link

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/layouts/portal.vue

@@ -32,6 +32,15 @@
                         class="border-t border-secondary-500 pt-6"
                         @click="ui.closeMobileSidebar()"
                     />
+                    <SidebarLink
+                        v-if="isAdmin"
+                        to="/"
+                        icon="mdi:shield-crown-outline"
+                        label="Administration"
+                        :collapsed="false"
+                        class="mt-2"
+                        @click="ui.closeMobileSidebar()"
+                    />
                 </nav>
 
                 <div class="flex flex-col gap-2 items-center p-4">
@@ -58,6 +67,8 @@ const ui = useUiStore()
 const route = useRoute()
 const { version } = useAppVersion()
 
+const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
+
 // Close mobile sidebar on route change
 watch(() => route.path, () => {
     ui.closeMobileSidebar()

frontend/middleware/auth.global.ts

@@ -11,12 +11,12 @@ export default defineNuxtRouteMiddleware(async (to) => {
     }
 
     if (isLogin && auth.isAuthenticated) {
-        const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        return navigateTo(isClient ? '/portal' : '/')
+        const isClientOnly = auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
+        return navigateTo(isClientOnly ? '/portal' : '/')
     }
 
-    // ROLE_CLIENT: redirect to /portal, block internal pages
-    if (auth.isAuthenticated && auth.user?.roles?.includes('ROLE_CLIENT')) {
+    // ROLE_CLIENT without ROLE_ADMIN: redirect to /portal, block internal pages
+    if (auth.isAuthenticated && auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')) {
         const isPortalRoute = to.path.startsWith('/portal')
         const isLoginRoute = to.path === '/login'
         if (!isPortalRoute && !isLoginRoute) {