refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

frontend/components/user/UserDrawer.vue

@@ -48,26 +48,6 @@
                 </div>
             </div>
 
-            <!-- Compte client (portail) -->
-            <div v-if="isClient" class="mt-6 border-t border-neutral-200 pt-4">
-                <p class="mb-3 text-sm font-semibold text-neutral-700">{{ $t('users.clientAccount') }}</p>
-                <MalioSelect
-                    v-model="form.client"
-                    :options="clientOptions"
-                    :label="$t('users.client')"
-                    group-class="w-full"
-                    empty-option-label="—"
-                />
-                <div class="mt-3">
-                    <MalioSelectCheckbox
-                        v-model="form.allowedProjects"
-                        :options="projectOptions"
-                        :label="$t('users.allowedProjects')"
-                        group-class="w-full"
-                    />
-                </div>
-            </div>
-
             <!-- RH / Absences -->
             <div class="mt-6 border-t border-neutral-200 pt-4">
                 <MalioCheckbox v-model="form.isEmployee" label="Employé (soumis à la gestion des absences)" />
@@ -91,8 +71,6 @@
 <script setup lang="ts">
 import type { UserData, UserWrite } from '~/services/dto/user-data'
 import { useUserService } from '~/services/users'
-import { useClientService } from '~/modules/directory/services/clients'
-import { useProjectService } from '~/modules/project-management/services/projects'
 
 const props = defineProps<{
     modelValue: boolean
@@ -109,7 +87,7 @@ const isOpen = computed({
     set: (v) => emit('update:modelValue', v),
 })
 
-const availableRoles = ['ROLE_ADMIN', 'ROLE_USER', 'ROLE_CLIENT']
+const availableRoles = ['ROLE_ADMIN', 'ROLE_USER']
 
 const isEditing = computed(() => !!props.item)
 const isSubmitting = ref(false)
@@ -121,52 +99,15 @@ const form = reactive({
     password: '',
     roles: [] as string[],
     isEmployee: false,
-    client: null as string | null,
-    allowedProjects: [] as string[],
 })
 
-const isClient = computed(() => form.roles.includes('ROLE_CLIENT'))
-
 const touched = reactive({
     username: false,
     password: false,
 })
 
-const clientOptions = ref<{ label: string, value: string | null }[]>([])
-const projectOptions = ref<{ label: string, value: string }[]>([])
-
-const { getAll: getClients } = useClientService()
-const { getAll: getProjects } = useProjectService()
 const { create, update, getById } = useUserService()
 
-async function loadOptions() {
-    if (clientOptions.value.length && projectOptions.value.length) {
-        return
-    }
-    const [clients, projects] = await Promise.all([getClients(), getProjects()])
-    clientOptions.value = clients.map((c) => ({
-        label: c.name,
-        value: c['@id'] ?? `/api/clients/${c.id}`,
-    }))
-    projectOptions.value = projects.map((p) => ({
-        label: p.name,
-        value: p['@id'] ?? `/api/projects/${p.id}`,
-    }))
-}
-
-/** Normalize allowedProjects (embedded objects or bare IRIs) into IRI strings. */
-function toProjectIris(allowed: UserData['allowedProjects'] | undefined): string[] {
-    if (!allowed) {
-        return []
-    }
-    return allowed.map((p) => {
-        if (typeof p === 'string') {
-            return p
-        }
-        return p['@id'] ?? `/api/projects/${p.id}`
-    })
-}
-
 function applyUser(user: UserData) {
     form.username = user.username ?? ''
     form.firstName = user.firstName ?? ''
@@ -174,8 +115,6 @@ function applyUser(user: UserData) {
     form.password = ''
     form.roles = [...user.roles]
     form.isEmployee = user.isEmployee ?? false
-    form.client = user.client ?? null
-    form.allowedProjects = toProjectIris(user.allowedProjects)
 }
 
 watch(() => props.modelValue, async (open) => {
@@ -185,10 +124,8 @@ watch(() => props.modelValue, async (open) => {
 
     touched.username = false
     touched.password = false
-    await loadOptions()
 
     if (props.item) {
-        // The list payload (user:list) omits client / allowedProjects → fetch the full item.
         applyUser(props.item)
         try {
             const full = await getById(props.item.id)
@@ -203,8 +140,6 @@ watch(() => props.modelValue, async (open) => {
         form.password = ''
         form.roles = ['ROLE_USER']
         form.isEmployee = false
-        form.client = null
-        form.allowedProjects = []
     }
 })
 
@@ -227,15 +162,6 @@ async function handleSubmit() {
             payload.plainPassword = form.password
         }
 
-        // Client portal fields: only relevant when the user is a client.
-        if (isClient.value) {
-            payload.client = form.client
-            payload.allowedProjects = form.allowedProjects
-        } else {
-            payload.client = null
-            payload.allowedProjects = []
-        }
-
         if (isEditing.value && props.item) {
             await update(props.item.id, payload)
         } else {