refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

frontend/app/middleware/auth.global.ts

@@ -14,22 +14,6 @@ export default defineNuxtRouteMiddleware(async (to) => {
         return navigateTo('/')
     }
 
-    // Cloisonnement portail client : un utilisateur ROLE_CLIENT "pur" (a ROLE_CLIENT
-    // mais PAS ROLE_USER) n'a accès qu'aux pages /portal. Toute autre route interne
-    // est redirigée vers /portal. Les ROLE_ADMIN / ROLE_USER ne sont pas concernés
-    // (ils peuvent aussi visiter /portal pour prévisualiser).
-    if (auth.isAuthenticated && !isLogin) {
-        const roles = auth.user?.roles ?? []
-        const isPureClient = roles.includes('ROLE_CLIENT') && !roles.includes('ROLE_USER')
-
-        if (isPureClient) {
-            const isPortalRoute = to.path === '/portal' || to.path.startsWith('/portal/')
-            if (!isPortalRoute) {
-                return navigateTo('/portal')
-            }
-        }
-    }
-
     const { loaded: sidebarLoaded, loadSidebar, resetSidebar } = useSidebar()
     const { loaded: modulesLoaded, loadModules, resetModules } = useModules()