fix(user) : clear allowedProjects when removing ROLE_CLIENT

Prevents sending /api/projects/undefined when saving a user after
removing client role. Also auto-clears client and projects when
ROLE_CLIENT checkbox is unchecked.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/components/user/UserDrawer.vue

@@ -148,6 +148,13 @@ function onClientChange(value: number | null) {
     }
 }
 
+watch(() => form.roles, (roles) => {
+    if (!roles.includes('ROLE_CLIENT')) {
+        form.clientId = null
+        form.allowedProjectIds = []
+    }
+})
+
 watch(() => props.modelValue, async (open) => {
     if (open) {
         if (props.item) {
@@ -189,7 +196,9 @@ async function handleSubmit() {
             username: form.username.trim(),
             roles: form.roles,
             client: form.clientId !== null ? `/api/clients/${form.clientId}` : null,
-            allowedProjects: form.allowedProjectIds.map((id) => `/api/projects/${id}`),
+            allowedProjects: form.clientId !== null
+                ? form.allowedProjectIds.map((id) => `/api/projects/${id}`)
+                : [],
         }
         if (form.password) {
             payload.plainPassword = form.password