feat(absences) : avancement module absences + suppression du portail client

Deux lots regroupés sur la branche feat/absence-management.

Suppression complète du portail client :
- retire ROLE_CLIENT (security.yaml) ; User::getRoles() ajoute toujours ROLE_USER
- supprime l'entité ClientTicket (+ repo, states, relations), User.client et
  User.allowedProjects, NotificationService, ProjectAllowedExtension, le bloc
  ROLE_CLIENT de MailAccessChecker
- front : pages /portal, layout portal, composants client-ticket/,
  AdminClientTicketTab, services/dto/i18n/docs associés
- fixtures : retire les users client-liot / client-acme
- migration Version20260522110000 (drop client_ticket, user_allowed_projects,
  colonnes liées ; task_document.task_id -> NOT NULL)
- tests : retire les cas obsolètes testant le blocage des clients sur le mail

Module gestion des absences (WIP) :
- entités / migrations (Version20260521160000, Version20260522090000)
- pages absences.vue / team-absences.vue, composants frontend/components/absence/
- services front, AccrueLeaveCommand, PublicHolidayController

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/pages/profile.vue

@@ -1,5 +1,5 @@
 <template>
-    <NuxtLayout :name="isClientOnly ? 'portal' : 'default'">
+    <NuxtLayout name="default">
     <div class="mx-auto max-w-lg px-4 py-10">
         <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
 
@@ -14,17 +14,18 @@
             <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
 
             <div class="flex gap-3">
-                <label
-                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                <MalioButton
+                    button-class="w-auto px-4"
+                    :label="$t('profile.changeAvatar')"
+                    @click="avatarInput?.click()"
+                />
+                <input
+                    ref="avatarInput"
+                    type="file"
+                    accept="image/jpeg,image/png,image/webp,image/gif"
+                    class="hidden"
+                    @change="onFileSelect"
                 >
-                    {{ $t('profile.changeAvatar') }}
-                    <input
-                        type="file"
-                        accept="image/jpeg,image/png,image/webp,image/gif"
-                        class="hidden"
-                        @change="onFileSelect"
-                    />
-                </label>
 
                 <MalioButton
                     v-if="auth.user?.avatarUrl"
@@ -39,7 +40,6 @@
 
         <!-- API Token MCP (interne uniquement) -->
         <div
-            v-if="!isClientOnly"
             class="mt-8 rounded-xl border border-neutral-200 bg-white p-6 shadow-sm"
         >
             <h2 class="mb-1 text-lg font-bold text-neutral-900">{{ $t('profile.apiToken.title') }}</h2>
@@ -134,10 +134,6 @@ const auth = useAuthStore()
 const toast = useToast()
 const { t } = useI18n()
 
-const isClientOnly = computed(() =>
-    auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
-)
-
 definePageMeta({
     layout: false,
 })
@@ -145,6 +141,7 @@ const { upload, remove } = useAvatarService()
 const { regenerate } = useApiTokenService()
 
 const selectedFile = ref<File | null>(null)
+const avatarInput = ref<HTMLInputElement | null>(null)
 const removing = ref(false)
 const regenerating = ref(false)
 const showConfirm = ref(false)