refactor(client-portal) : remove client portal feature entirely

- drop ClientPortal module, ClientTicket entity, ROLE_CLIENT and all couplings (Task, TaskDocument, User, Notification) back to an internal-only model

- migration drops client_ticket / user_allowed_projects / related FK columns and removes leftover external client accounts (would otherwise be promoted to ROLE_USER)

- remove client-portal frontend module, admin tickets tab, user portal section, portal nav item and portal/clientTicket i18n keys

- fix directory nav icon (invalid mdi:contact-multiple-outline -> mdi:card-account-details-outline)

- add 'make sync-permissions' target, wire it into install/db-reset and the prod deploy script

src/Shared/Domain/Contract/UserInterface.php

@@ -4,8 +4,6 @@ declare(strict_types=1);
 
 namespace App\Shared\Domain\Contract;
 
-use Doctrine\Common\Collections\Collection;
-
 /**
  * Contrat de LECTURE de l'identité, consommé hors du module Core.
  * Les écritures (setPassword, setters HR…) restent sur le concret Core\Domain\Entity\User.
@@ -31,16 +29,4 @@ interface UserInterface
 
     /** @return list<string> */
     public function getEffectivePermissions(): array;
-
-    /**
-     * Client this user belongs to, or null for an internal user.
-     */
-    public function getClient(): ?ClientInterface;
-
-    /**
-     * Projects a client user is allowed to access.
-     *
-     * @return Collection<int, ProjectInterface>
-     */
-    public function getAllowedProjects(): Collection;
 }