feat(client-portal) : portal front + client account admin (phases 1-2 front)

LST-69 (3.2) front. Client portal UI on the phase-1 backend.

- New frontend/modules/client-portal/ layer: /portal (project cards from the
  client's allowedProjects via /me), /portal/projects/[id] (tickets list,
  detail modal, create modal with document upload), client-tickets service +
  DTO, CT-XXX formatting.
- Front tenancy: auth.global.ts redirects a pure ROLE_CLIENT to /portal and
  blocks internal routes; portal pages open to any authenticated user.
- Admin: UserDrawer manages client accounts (ROLE_CLIENT + client +
  allowedProjects); new "Tickets client" admin tab (list, filters, status
  change with required comment on reject, detail modal).
- Kanban/my-tasks: client-ticket icon + tooltip when task.clientTicket is set
  (data via task:read, no extra call). TaskDocument upload generalized with a
  clientTicketId prop. getContent uses native fetch (text response).
- i18n portal/clientTicket keys; sidebar /portal item (module client-portal).

nuxt build passes; /portal routes present, existing routes intact.

frontend/app/middleware/auth.global.ts

@@ -14,6 +14,22 @@ export default defineNuxtRouteMiddleware(async (to) => {
         return navigateTo('/')
     }
 
+    // Cloisonnement portail client : un utilisateur ROLE_CLIENT "pur" (a ROLE_CLIENT
+    // mais PAS ROLE_USER) n'a accès qu'aux pages /portal. Toute autre route interne
+    // est redirigée vers /portal. Les ROLE_ADMIN / ROLE_USER ne sont pas concernés
+    // (ils peuvent aussi visiter /portal pour prévisualiser).
+    if (auth.isAuthenticated && !isLogin) {
+        const roles = auth.user?.roles ?? []
+        const isPureClient = roles.includes('ROLE_CLIENT') && !roles.includes('ROLE_USER')
+
+        if (isPureClient) {
+            const isPortalRoute = to.path === '/portal' || to.path.startsWith('/portal/')
+            if (!isPortalRoute) {
+                return navigateTo('/portal')
+            }
+        }
+    }
+
     const { loaded: sidebarLoaded, loadSidebar, resetSidebar } = useSidebar()
     const { loaded: modulesLoaded, loadModules, resetModules } = useModules()
 

frontend/app/middleware/portal.ts

@@ -0,0 +1,12 @@
+/**
+ * Named middleware for portal pages (`/portal/**`).
+ * Ensures the user is authenticated. Access is open to every authenticated user
+ * (ROLE_CLIENT see their portal, ROLE_ADMIN/ROLE_USER may preview it).
+ */
+export default defineNuxtRouteMiddleware(() => {
+    const auth = useAuthStore()
+
+    if (!auth.isAuthenticated) {
+        return navigateTo('/login')
+    }
+})