refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

src/Module/ProjectManagement/Infrastructure/ApiPlatform/State/TaskDocumentProvider.php

@@ -12,12 +12,6 @@ use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
 
 /**
- * Provider for TaskDocument read operations.
- *
- * - ROLE_ADMIN: every document.
- * - ROLE_USER: documents attached to a task (task IS NOT NULL).
- * - ROLE_CLIENT: documents attached to a client ticket the user submitted.
- *
  * @implements ProviderInterface<TaskDocument>
  */
 final readonly class TaskDocumentProvider implements ProviderInterface
@@ -32,56 +26,25 @@ final readonly class TaskDocumentProvider implements ProviderInterface
         $user = $this->security->getUser();
         assert($user instanceof UserInterface);
 
-        $isAdmin  = $this->security->isGranted('ROLE_ADMIN');
-        $isClient = $this->security->isGranted('ROLE_CLIENT');
-
         $repo = $this->entityManager->getRepository(TaskDocument::class);
 
-        // Single item.
+        // Single item
         if (isset($uriVariables['id'])) {
-            $document = $repo->find($uriVariables['id']);
-            if (null === $document) {
-                return null;
-            }
-            if ($isAdmin) {
-                return $document;
-            }
-            if ($isClient) {
-                $ticket = $document->getClientTicket();
-
-                return null !== $ticket && $ticket->getSubmittedBy() === $user ? $document : null;
-            }
-
-            // ROLE_USER: task-linked documents only.
-            return null !== $document->getTask() ? $document : null;
+            return $repo->find($uriVariables['id']);
         }
 
-        // Collection.
+        // Collection
         $qb = $repo->createQueryBuilder('d')
             ->orderBy('d.id', 'DESC')
         ;
 
-        if ($isClient && !$isAdmin) {
-            $qb->innerJoin('d.clientTicket', 'ct')
-                ->andWhere('ct.submittedBy = :user')
-                ->setParameter('user', $user)
-            ;
-        } elseif (!$isAdmin) {
-            // ROLE_USER: only documents attached to a task.
-            $qb->andWhere('d.task IS NOT NULL');
-        }
-
+        // Apply filters from query parameters
         $filters = $context['filters'] ?? [];
         if (isset($filters['task'])) {
             $qb->andWhere('d.task = :task')
                 ->setParameter('task', self::extractId($filters['task']))
             ;
         }
-        if (isset($filters['clientTicket'])) {
-            $qb->andWhere('d.clientTicket = :clientTicket')
-                ->setParameter('clientTicket', self::extractId($filters['clientTicket']))
-            ;
-        }
 
         return $qb->getQuery()->getResult();
     }