refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

src/Module/Core/Domain/Entity/User.php

@@ -18,9 +18,7 @@ use App\Module\Core\Infrastructure\ApiPlatform\State\UserPasswordHasherProcessor
 use App\Module\Core\Infrastructure\Doctrine\DoctrineUserRepository;
 use App\Shared\Domain\Attribute\Auditable;
 use App\Shared\Domain\Attribute\AuditIgnore;
-use App\Shared\Domain\Contract\ClientInterface;
 use App\Shared\Domain\Contract\LeaveProfileInterface;
-use App\Shared\Domain\Contract\ProjectInterface;
 use App\Shared\Domain\Contract\UserInterface as SharedUserInterface;
 use DateTimeImmutable;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -177,34 +175,11 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
     #[Groups(['user:rbac:read', 'user:rbac:write'])]
     private Collection $directPermissions;
 
-    // --- Client portal fields ---
-
-    /** Client this user belongs to. null = internal user, set = client user. */
-    #[ORM\ManyToOne(targetEntity: ClientInterface::class)]
-    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', nullable: true, onDelete: 'SET NULL')]
-    #[Groups(['me:read', 'user:read', 'user:write'])]
-    private ?ClientInterface $client = null;
-
-    /**
-     * Projects a client user is allowed to access (a subset of the client's projects).
-     *
-     * @var Collection<int, ProjectInterface>
-     */
-    #[ORM\ManyToMany(targetEntity: ProjectInterface::class)]
-    #[ORM\JoinTable(
-        name: 'user_allowed_projects',
-        joinColumns: [new ORM\JoinColumn(name: 'user_id', referencedColumnName: 'id', onDelete: 'CASCADE')],
-        inverseJoinColumns: [new ORM\JoinColumn(name: 'project_id', referencedColumnName: 'id', onDelete: 'CASCADE')],
-    )]
-    #[Groups(['me:read', 'user:read', 'user:write'])]
-    private Collection $allowedProjects;
-
     public function __construct()
     {
         $this->createdAt         = new DateTimeImmutable();
         $this->rbacRoles         = new ArrayCollection();
         $this->directPermissions = new ArrayCollection();
-        $this->allowedProjects   = new ArrayCollection();
     }
 
     public function getId(): ?int
@@ -258,11 +233,8 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
     {
         $roles = $this->roles;
 
-        // A client user must NOT inherit ROLE_USER (which would grant access to
-        // the internal application). Only non-client users get ROLE_USER.
-        if (!in_array('ROLE_CLIENT', $roles, true)) {
-            $roles[] = 'ROLE_USER';
-        }
+        // Every authenticated user gets ROLE_USER.
+        $roles[] = 'ROLE_USER';
 
         return array_values(array_unique($roles));
     }
@@ -486,42 +458,6 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface, SharedU
         $this->directPermissions->removeElement($permission);
     }
 
-    public function getClient(): ?ClientInterface
-    {
-        return $this->client;
-    }
-
-    public function setClient(?ClientInterface $client): static
-    {
-        $this->client = $client;
-
-        return $this;
-    }
-
-    /**
-     * @return Collection<int, ProjectInterface>
-     */
-    public function getAllowedProjects(): Collection
-    {
-        return $this->allowedProjects;
-    }
-
-    public function addAllowedProject(ProjectInterface $project): static
-    {
-        if (!$this->allowedProjects->contains($project)) {
-            $this->allowedProjects->add($project);
-        }
-
-        return $this;
-    }
-
-    public function removeAllowedProject(ProjectInterface $project): static
-    {
-        $this->allowedProjects->removeElement($project);
-
-        return $this;
-    }
-
     /**
      * Permissions effectives = union (rôles RBAC → permissions) ∪ (permissions directes), triée, dédupliquée.
      *