feat(client-portal) : portal front + client account admin (phases 1-2 front)

LST-69 (3.2) front. Client portal UI on the phase-1 backend.

- New frontend/modules/client-portal/ layer: /portal (project cards from the
  client's allowedProjects via /me), /portal/projects/[id] (tickets list,
  detail modal, create modal with document upload), client-tickets service +
  DTO, CT-XXX formatting.
- Front tenancy: auth.global.ts redirects a pure ROLE_CLIENT to /portal and
  blocks internal routes; portal pages open to any authenticated user.
- Admin: UserDrawer manages client accounts (ROLE_CLIENT + client +
  allowedProjects); new "Tickets client" admin tab (list, filters, status
  change with required comment on reject, detail modal).
- Kanban/my-tasks: client-ticket icon + tooltip when task.clientTicket is set
  (data via task:read, no extra call). TaskDocument upload generalized with a
  clientTicketId prop. getContent uses native fetch (text response).
- i18n portal/clientTicket keys; sidebar /portal item (module client-portal).

nuxt build passes; /portal routes present, existing routes intact.

frontend/modules/client-portal/components/ClientTicketStatusBadge.vue

@@ -0,0 +1,25 @@
+<template>
+    <span
+        class="inline-flex items-center rounded-full px-2 py-0.5 text-xs font-semibold"
+        :class="classes"
+    >
+        {{ $t(`clientTicket.status.${status}`) }}
+    </span>
+</template>
+
+<script setup lang="ts">
+import type { ClientTicketStatus } from '~/modules/client-portal/services/dto/client-ticket'
+
+const props = defineProps<{
+    status: ClientTicketStatus
+}>()
+
+const STATUS_CONFIG: Record<ClientTicketStatus, string> = {
+    new: 'bg-sky-100 text-sky-700',
+    in_progress: 'bg-amber-100 text-amber-700',
+    done: 'bg-green-100 text-green-700',
+    rejected: 'bg-neutral-200 text-neutral-600',
+}
+
+const classes = computed(() => STATUS_CONFIG[props.status] ?? STATUS_CONFIG.new)
+</script>