feat(client-portal) : portal front + client account admin (phases 1-2 front)

LST-69 (3.2) front. Client portal UI on the phase-1 backend.

- New frontend/modules/client-portal/ layer: /portal (project cards from the
  client's allowedProjects via /me), /portal/projects/[id] (tickets list,
  detail modal, create modal with document upload), client-tickets service +
  DTO, CT-XXX formatting.
- Front tenancy: auth.global.ts redirects a pure ROLE_CLIENT to /portal and
  blocks internal routes; portal pages open to any authenticated user.
- Admin: UserDrawer manages client accounts (ROLE_CLIENT + client +
  allowedProjects); new "Tickets client" admin tab (list, filters, status
  change with required comment on reject, detail modal).
- Kanban/my-tasks: client-ticket icon + tooltip when task.clientTicket is set
  (data via task:read, no extra call). TaskDocument upload generalized with a
  clientTicketId prop. getContent uses native fetch (text response).
- i18n portal/clientTicket keys; sidebar /portal item (module client-portal).

nuxt build passes; /portal routes present, existing routes intact.

frontend/services/dto/user-data.ts

@@ -1,5 +1,15 @@
 export type ContractType = 'CDI' | 'CDD' | 'STAGE' | 'ALTERNANCE' | 'AUTRE'
 
+/**
+ * Project as embedded in the `me:read` serialization group (id + name).
+ * On `/me`, `allowedProjects` is returned as embedded objects, not bare IRIs.
+ */
+export type AllowedProject = {
+    '@id'?: string
+    id: number
+    name: string
+}
+
 export type UserData = {
     id: number
     '@id'?: string
@@ -10,6 +20,9 @@ export type UserData = {
     effectivePermissions?: string[]
     avatarUrl?: string | null
     apiToken?: string | null
+    // Client portal
+    client?: string | null                  // IRI of the linked Client (null = internal user)
+    allowedProjects?: AllowedProject[]      // Projects a client user can access (embedded id + name)
     // HR / absence management
     isEmployee?: boolean
     hireDate?: string | null
@@ -27,6 +40,9 @@ export type UserWrite = {
     lastName?: string | null
     plainPassword?: string
     roles: string[]
+    // Client portal
+    client?: string | null
+    allowedProjects?: string[]
     // HR / absence management
     isEmployee?: boolean
     hireDate?: string | null

frontend/services/users.ts

@@ -10,6 +10,10 @@ export function useUserService() {
         return extractHydraMembers(data)
     }
 
+    async function getById(id: number): Promise<UserData> {
+        return api.get<UserData>(`/users/${id}`)
+    }
+
     async function create(payload: UserWrite): Promise<UserData> {
         return api.post<UserData>('/users', payload as Record<string, unknown>, {
             toastSuccessKey: 'users.created',
@@ -28,5 +32,5 @@ export function useUserService() {
         })
     }
 
-    return { getAll, create, update, remove }
+    return { getAll, getById, create, update, remove }
 }