refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

frontend/modules/project-management/services/task-documents.ts

@@ -15,13 +15,6 @@ export function useTaskDocumentService() {
         return extractHydraMembers(data)
     }
 
-    async function getByClientTicket(clientTicketId: number): Promise<TaskDocument[]> {
-        const data = await api.get<HydraCollection<TaskDocument>>('/task_documents', {
-            clientTicket: `/api/client_tickets/${clientTicketId}`,
-        })
-        return extractHydraMembers(data)
-    }
-
     async function uploadWithRelation(relationField: string, relationIri: string, file: File): Promise<TaskDocument> {
         const formData = new FormData()
         formData.append('file', file)
@@ -38,10 +31,6 @@ export function useTaskDocumentService() {
         return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
     }
 
-    async function uploadForClientTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
-    }
-
     async function linkShare(taskId: number, sharePath: string): Promise<TaskDocument> {
         return $fetch<TaskDocument>(`${baseURL}/task_documents`, {
             method: 'POST',
@@ -69,5 +58,5 @@ export function useTaskDocumentService() {
         return response.text()
     }
 
-    return { getByTask, getByClientTicket, upload, uploadForClientTicket, linkShare, remove, getDownloadUrl, getContent }
+    return { getByTask, upload, linkShare, remove, getDownloadUrl, getContent }
 }