refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

frontend/components/notification/NotificationBell.vue

@@ -102,22 +102,11 @@ function toggleDropdown() {
     }
 }
 
-const auth = useAuthStore()
-
-const isAdmin = computed(() => (auth.user?.roles ?? []).includes('ROLE_ADMIN'))
-
 function handleClick(notif: Notification) {
     if (!notif.isRead) {
         markAsRead(notif.id)
     }
     isOpen.value = false
-
-    // Deep-link to the related ticket when present. The notification payload does
-    // not carry the ticket's project, so we route to the relevant list view:
-    // admins to the client-tickets admin tab, clients to their portal.
-    if (notif.relatedTicket) {
-        navigateTo(isAdmin.value ? '/admin' : '/portal')
-    }
 }
 
 async function handleMarkAllRead() {