feat(client-portal) : portal front + client account admin (phases 1-2 front)

LST-69 (3.2) front. Client portal UI on the phase-1 backend.

- New frontend/modules/client-portal/ layer: /portal (project cards from the
  client's allowedProjects via /me), /portal/projects/[id] (tickets list,
  detail modal, create modal with document upload), client-tickets service +
  DTO, CT-XXX formatting.
- Front tenancy: auth.global.ts redirects a pure ROLE_CLIENT to /portal and
  blocks internal routes; portal pages open to any authenticated user.
- Admin: UserDrawer manages client accounts (ROLE_CLIENT + client +
  allowedProjects); new "Tickets client" admin tab (list, filters, status
  change with required comment on reject, detail modal).
- Kanban/my-tasks: client-ticket icon + tooltip when task.clientTicket is set
  (data via task:read, no extra call). TaskDocument upload generalized with a
  clientTicketId prop. getContent uses native fetch (text response).
- i18n portal/clientTicket keys; sidebar /portal item (module client-portal).

nuxt build passes; /portal routes present, existing routes intact.

frontend/components/user/UserDrawer.vue

@@ -48,6 +48,26 @@
                 </div>
             </div>
 
+            <!-- Compte client (portail) -->
+            <div v-if="isClient" class="mt-6 border-t border-neutral-200 pt-4">
+                <p class="mb-3 text-sm font-semibold text-neutral-700">{{ $t('users.clientAccount') }}</p>
+                <MalioSelect
+                    v-model="form.client"
+                    :options="clientOptions"
+                    :label="$t('users.client')"
+                    group-class="w-full"
+                    empty-option-label="—"
+                />
+                <div class="mt-3">
+                    <MalioSelectCheckbox
+                        v-model="form.allowedProjects"
+                        :options="projectOptions"
+                        :label="$t('users.allowedProjects')"
+                        group-class="w-full"
+                    />
+                </div>
+            </div>
+
             <!-- RH / Absences -->
             <div class="mt-6 border-t border-neutral-200 pt-4">
                 <MalioCheckbox v-model="form.isEmployee" label="Employé (soumis à la gestion des absences)" />
@@ -71,6 +91,8 @@
 <script setup lang="ts">
 import type { UserData, UserWrite } from '~/services/dto/user-data'
 import { useUserService } from '~/services/users'
+import { useClientService } from '~/modules/directory/services/clients'
+import { useProjectService } from '~/modules/project-management/services/projects'
 
 const props = defineProps<{
     modelValue: boolean
@@ -87,7 +109,7 @@ const isOpen = computed({
     set: (v) => emit('update:modelValue', v),
 })
 
-const availableRoles = ['ROLE_ADMIN', 'ROLE_USER']
+const availableRoles = ['ROLE_ADMIN', 'ROLE_USER', 'ROLE_CLIENT']
 
 const isEditing = computed(() => !!props.item)
 const isSubmitting = ref(false)
@@ -99,37 +121,93 @@ const form = reactive({
     password: '',
     roles: [] as string[],
     isEmployee: false,
+    client: null as string | null,
+    allowedProjects: [] as string[],
 })
 
+const isClient = computed(() => form.roles.includes('ROLE_CLIENT'))
+
 const touched = reactive({
     username: false,
     password: false,
 })
 
-watch(() => props.modelValue, (open) => {
-    if (open) {
-        if (props.item) {
-            form.username = props.item.username ?? ''
-            form.firstName = props.item.firstName ?? ''
-            form.lastName = props.item.lastName ?? ''
-            form.password = ''
-            form.roles = [...props.item.roles]
-            form.isEmployee = props.item.isEmployee ?? false
-        } else {
-            form.username = ''
-            form.firstName = ''
-            form.lastName = ''
-            form.password = ''
-            form.roles = ['ROLE_USER']
-            form.isEmployee = false
+const clientOptions = ref<{ label: string, value: string | null }[]>([])
+const projectOptions = ref<{ label: string, value: string }[]>([])
+
+const { getAll: getClients } = useClientService()
+const { getAll: getProjects } = useProjectService()
+const { create, update, getById } = useUserService()
+
+async function loadOptions() {
+    if (clientOptions.value.length && projectOptions.value.length) {
+        return
+    }
+    const [clients, projects] = await Promise.all([getClients(), getProjects()])
+    clientOptions.value = clients.map((c) => ({
+        label: c.name,
+        value: c['@id'] ?? `/api/clients/${c.id}`,
+    }))
+    projectOptions.value = projects.map((p) => ({
+        label: p.name,
+        value: p['@id'] ?? `/api/projects/${p.id}`,
+    }))
+}
+
+/** Normalize allowedProjects (embedded objects or bare IRIs) into IRI strings. */
+function toProjectIris(allowed: UserData['allowedProjects'] | undefined): string[] {
+    if (!allowed) {
+        return []
+    }
+    return allowed.map((p) => {
+        if (typeof p === 'string') {
+            return p
         }
-        touched.username = false
-        touched.password = false
+        return p['@id'] ?? `/api/projects/${p.id}`
+    })
+}
+
+function applyUser(user: UserData) {
+    form.username = user.username ?? ''
+    form.firstName = user.firstName ?? ''
+    form.lastName = user.lastName ?? ''
+    form.password = ''
+    form.roles = [...user.roles]
+    form.isEmployee = user.isEmployee ?? false
+    form.client = user.client ?? null
+    form.allowedProjects = toProjectIris(user.allowedProjects)
+}
+
+watch(() => props.modelValue, async (open) => {
+    if (!open) {
+        return
+    }
+
+    touched.username = false
+    touched.password = false
+    await loadOptions()
+
+    if (props.item) {
+        // The list payload (user:list) omits client / allowedProjects → fetch the full item.
+        applyUser(props.item)
+        try {
+            const full = await getById(props.item.id)
+            applyUser(full)
+        } catch {
+            // Keep the list data if the detailed fetch fails.
+        }
+    } else {
+        form.username = ''
+        form.firstName = ''
+        form.lastName = ''
+        form.password = ''
+        form.roles = ['ROLE_USER']
+        form.isEmployee = false
+        form.client = null
+        form.allowedProjects = []
     }
 })
 
-const { create, update } = useUserService()
-
 async function handleSubmit() {
     touched.username = true
     touched.password = true
@@ -149,6 +227,15 @@ async function handleSubmit() {
             payload.plainPassword = form.password
         }
 
+        // Client portal fields: only relevant when the user is a client.
+        if (isClient.value) {
+            payload.client = form.client
+            payload.allowedProjects = form.allowedProjects
+        } else {
+            payload.client = null
+            payload.allowedProjects = []
+        }
+
         if (isEditing.value && props.item) {
             await update(props.item.id, payload)
         } else {