feat(client-portal) : phase 1 foundations — ROLE_CLIENT hardening + ClientTicket (back)

LST-69 (3.2) phase 1. New ClientPortal module + security foundations for the
client portal (spec docs/superpowers/specs/2026-03-15-client-portal-design.md).

- Security: User::getRoles() no longer adds ROLE_USER to ROLE_CLIENT users;
  role_hierarchy ROLE_ADMIN: [ROLE_USER, ROLE_CLIENT]. Existing Task/Project/
  Client/TimeEntry/metadata endpoints already required ROLE_USER -> a pure
  ROLE_CLIENT is walled off (verified: 403).
- User (Core): client (ManyToOne ClientInterface, SET NULL) + allowedProjects
  (ManyToMany ProjectInterface). UserInterface extended (getClient/
  getAllowedProjects).
- New ClientTicket entity (module ClientPortal) + enums + repository + API with
  per-client isolation (ClientTicketProvider: own tickets ∩ allowedProjects),
  per-project numbering under advisory lock (rejects if user.client null),
  status transition rules. ClientTicketInterface contract for Task/TaskDocument.
- TaskDocument generalized: task nullable + clientTicket (CASCADE) + CHECK;
  per-role access. Task.clientTicket exposed in task:read.
- Additive migration; demo client fixtures.
- Tenancy tests assert the isolation invariant (a client never sees another
  client's tickets) rather than brittle absolute counts (shared test DB).

178 tests green, mapping valid, cs-fixer clean.

src/Module/Core/Domain/Entity/User.php

@@ -18,7 +18,9 @@ use App\Module\Core\Infrastructure\ApiPlatform\State\UserPasswordHasherProcessor
 use App\Module\Core\Infrastructure\Doctrine\DoctrineUserRepository;
 use App\Shared\Domain\Attribute\Auditable;
 use App\Shared\Domain\Attribute\AuditIgnore;
+use App\Shared\Domain\Contract\ClientInterface;
 use App\Shared\Domain\Contract\LeaveProfileInterface;
+use App\Shared\Domain\Contract\ProjectInterface;
 use App\Shared\Domain\Contract\UserInterface as SharedUserInterface;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -173,11 +175,34 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
     #[Groups(['user:rbac:read', 'user:rbac:write'])]
     private Collection $directPermissions;
 
+    // --- Client portal fields ---
+
+    /** Client this user belongs to. null = internal user, set = client user. */
+    #[ORM\ManyToOne(targetEntity: ClientInterface::class)]
+    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['me:read', 'user:read', 'user:write'])]
+    private ?ClientInterface $client = null;
+
+    /**
+     * Projects a client user is allowed to access (a subset of the client's projects).
+     *
+     * @var Collection<int, ProjectInterface>
+     */
+    #[ORM\ManyToMany(targetEntity: ProjectInterface::class)]
+    #[ORM\JoinTable(
+        name: 'user_allowed_projects',
+        joinColumns: [new ORM\JoinColumn(name: 'user_id', referencedColumnName: 'id', onDelete: 'CASCADE')],
+        inverseJoinColumns: [new ORM\JoinColumn(name: 'project_id', referencedColumnName: 'id', onDelete: 'CASCADE')],
+    )]
+    #[Groups(['me:read', 'user:read', 'user:write'])]
+    private Collection $allowedProjects;
+
     public function __construct()
     {
         $this->createdAt         = new DateTimeImmutable();
         $this->rbacRoles         = new ArrayCollection();
         $this->directPermissions = new ArrayCollection();
+        $this->allowedProjects   = new ArrayCollection();
     }
 
     public function getId(): ?int
@@ -229,8 +254,13 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
     /** @return list<string> */
     public function getRoles(): array
     {
-        $roles   = $this->roles;
-        $roles[] = 'ROLE_USER';
+        $roles = $this->roles;
+
+        // A client user must NOT inherit ROLE_USER (which would grant access to
+        // the internal application). Only non-client users get ROLE_USER.
+        if (!in_array('ROLE_CLIENT', $roles, true)) {
+            $roles[] = 'ROLE_USER';
+        }
 
         return array_values(array_unique($roles));
     }
@@ -454,6 +484,42 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
         $this->directPermissions->removeElement($permission);
     }
 
+    public function getClient(): ?ClientInterface
+    {
+        return $this->client;
+    }
+
+    public function setClient(?ClientInterface $client): static
+    {
+        $this->client = $client;
+
+        return $this;
+    }
+
+    /**
+     * @return Collection<int, ProjectInterface>
+     */
+    public function getAllowedProjects(): Collection
+    {
+        return $this->allowedProjects;
+    }
+
+    public function addAllowedProject(ProjectInterface $project): static
+    {
+        if (!$this->allowedProjects->contains($project)) {
+            $this->allowedProjects->add($project);
+        }
+
+        return $this;
+    }
+
+    public function removeAllowedProject(ProjectInterface $project): static
+    {
+        $this->allowedProjects->removeElement($project);
+
+        return $this;
+    }
+
     /**
      * Permissions effectives = union (rôles RBAC → permissions) ∪ (permissions directes), triée, dédupliquée.
      *