refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

src/Module/ProjectManagement/Domain/Entity/TaskDocument.php

@@ -14,7 +14,6 @@ use ApiPlatform\Metadata\Post;
 use App\Module\ProjectManagement\Infrastructure\ApiPlatform\State\TaskDocumentProcessor;
 use App\Module\ProjectManagement\Infrastructure\ApiPlatform\State\TaskDocumentProvider;
 use App\Module\ProjectManagement\Infrastructure\EventListener\TaskDocumentListener;
-use App\Shared\Domain\Contract\ClientTicketInterface;
 use App\Shared\Domain\Contract\UserInterface;
 use DateTimeImmutable;
 use Doctrine\ORM\Mapping as ORM;
@@ -22,10 +21,10 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')", provider: TaskDocumentProvider::class),
-        new Get(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')", provider: TaskDocumentProvider::class),
+        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
+        new Get(security: "is_granted('ROLE_USER')", provider: TaskDocumentProvider::class),
         new Post(
-            security: "is_granted('ROLE_ADMIN') or is_granted('ROLE_CLIENT')",
+            security: "is_granted('ROLE_ADMIN')",
             processor: TaskDocumentProcessor::class,
             deserialize: false,
         ),
@@ -35,11 +34,9 @@ use Symfony\Component\Serializer\Attribute\Groups;
     denormalizationContext: ['groups' => ['task_document:write']],
     order: ['id' => 'DESC'],
 )]
-#[ApiFilter(SearchFilter::class, properties: ['task' => 'exact', 'clientTicket' => 'exact'])]
+#[ApiFilter(SearchFilter::class, properties: ['task' => 'exact'])]
 #[ORM\Entity]
 #[ORM\EntityListeners([TaskDocumentListener::class])]
-// A document must be attached to either a task or a client ticket.
-#[ORM\Table(name: 'task_document')]
 class TaskDocument
 {
     #[ORM\Id]
@@ -49,16 +46,10 @@ class TaskDocument
     private ?int $id = null;
 
     #[ORM\ManyToOne(targetEntity: Task::class, inversedBy: 'documents')]
-    #[ORM\JoinColumn(name: 'task_id', referencedColumnName: 'id', nullable: true, onDelete: 'CASCADE')]
+    #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     #[Groups(['task_document:read', 'task_document:write'])]
     private ?Task $task = null;
 
-    /** Client ticket this document is attached to (alternative to task). */
-    #[ORM\ManyToOne(targetEntity: ClientTicketInterface::class)]
-    #[ORM\JoinColumn(name: 'client_ticket_id', referencedColumnName: 'id', nullable: true, onDelete: 'CASCADE')]
-    #[Groups(['task_document:read', 'task_document:write', 'client_ticket:read'])]
-    private ?ClientTicketInterface $clientTicket = null;
-
     #[ORM\Column(length: 255)]
     #[Groups(['task_document:read', 'task:read'])]
     private ?string $originalName = null;
@@ -109,18 +100,6 @@ class TaskDocument
         return $this;
     }
 
-    public function getClientTicket(): ?ClientTicketInterface
-    {
-        return $this->clientTicket;
-    }
-
-    public function setClientTicket(?ClientTicketInterface $clientTicket): static
-    {
-        $this->clientTicket = $clientTicket;
-
-        return $this;
-    }
-
     public function getOriginalName(): ?string
     {
         return $this->originalName;