refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

frontend/services/dto/notification.ts

@@ -1,4 +1,4 @@
-export type NotificationType = 'ticket_created' | 'ticket_status_changed'
+export type NotificationType = 'task_assigned' | 'task_collaborator_added'
 
 export type Notification = {
     '@id'?: string
@@ -7,7 +7,6 @@ export type Notification = {
     type: NotificationType
     title: string
     message: string
-    relatedTicket: string | null
     isRead: boolean
     createdAt: string
 }

frontend/services/dto/user-data.ts

@@ -1,15 +1,5 @@
 export type ContractType = 'CDI' | 'CDD' | 'STAGE' | 'ALTERNANCE' | 'AUTRE'
 
-/**
- * Project as embedded in the `me:read` serialization group (id + name).
- * On `/me`, `allowedProjects` is returned as embedded objects, not bare IRIs.
- */
-export type AllowedProject = {
-    '@id'?: string
-    id: number
-    name: string
-}
-
 export type UserData = {
     id: number
     '@id'?: string
@@ -20,9 +10,6 @@ export type UserData = {
     effectivePermissions?: string[]
     avatarUrl?: string | null
     apiToken?: string | null
-    // Client portal
-    client?: string | null                  // IRI of the linked Client (null = internal user)
-    allowedProjects?: AllowedProject[]      // Projects a client user can access (embedded id + name)
     // HR / absence management
     isEmployee?: boolean
     hireDate?: string | null
@@ -40,9 +27,6 @@ export type UserWrite = {
     lastName?: string | null
     plainPassword?: string
     roles: string[]
-    // Client portal
-    client?: string | null
-    allowedProjects?: string[]
     // HR / absence management
     isEmployee?: boolean
     hireDate?: string | null