IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

IT_asset_management/app/routes/settings.py

@@ -3,6 +3,7 @@ from flask_login import login_required, current_user
 from app.extensions import db
 from app.models.admin_user import AdminUser
 from app.utils.decorators import admin_required
+from app.utils.portal_sso import _portal_role_to_local
 
 bp = Blueprint('settings', __name__, url_prefix='/settings')
 
@@ -104,3 +105,63 @@ def delete_admin(admin_id):
     db.session.commit()
     flash(f'User "{username}" deleted.', 'success')
     return redirect(url_for('settings.index'))
+
+
+@bp.route('/sync-from-portal', methods=['POST'])
+@login_required
+@admin_required
+def sync_from_portal():
+    """Pull all portal users with itassets access and upsert them locally."""
+    import urllib.request
+    import json as _json
+
+    portal_url = current_app.config.get('PORTAL_INTERNAL_URL', 'http://localhost:5001')
+    secret = current_app.config.get('INTERNAL_SYNC_SECRET', '')
+    url = portal_url.rstrip('/') + '/api/internal/itassets-users'
+
+    try:
+        req = urllib.request.Request(
+            url,
+            headers={'X-Internal-Token': secret},
+            method='GET',
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            users = _json.loads(resp.read())
+    except Exception as exc:
+        flash(f'Could not reach portal: {exc}', 'danger')
+        return redirect(url_for('settings.index'))
+
+    created = updated = 0
+    for u in users:
+        username = u.get('username', '').strip()
+        email = u.get('email', '') or f'{username}@portal.local'
+        local_role = _portal_role_to_local(u.get('app_role', 'standard'))
+        if not username:
+            continue
+        existing = AdminUser.query.filter_by(username=username).first()
+        if existing:
+            changed = False
+            if existing.role != local_role:
+                existing.role = local_role
+                changed = True
+            if existing.email != email:
+                existing.email = email
+                changed = True
+            if changed:
+                updated += 1
+        else:
+            import secrets as _sec
+            new_user = AdminUser(
+                username=username,
+                email=email,
+                full_name=username,
+                role=local_role,
+                is_active=True,
+            )
+            new_user.set_password(_sec.token_hex(32))
+            db.session.add(new_user)
+            created += 1
+
+    db.session.commit()
+    flash(f'Portal sync complete — {created} created, {updated} updated.', 'success')
+    return redirect(url_for('settings.index'))

IT_asset_management/app/templates/base.html

@@ -190,7 +190,10 @@
     <span class="badge ms-1 {% if current_user.role == 'admin' %}bg-danger{% elif current_user.role == 'editor' %}bg-primary{% else %}bg-secondary{% endif %}" style="font-size:.65rem;">
       {{ current_user.role }}
     </span>
-    <a href="{{ url_for('auth.logout') }}" class="ms-2 text-warning text-decoration-none">
+    <a href="/" class="ms-2 text-info text-decoration-none" title="Back to Portal">
+      <i class="bi bi-house-door"></i>
+    </a>
+    <a href="{{ url_for('auth.logout') }}" class="ms-1 text-warning text-decoration-none" title="Sign out">
       <i class="bi bi-box-arrow-right"></i>
     </a>
   </div>

IT_asset_management/app/templates/settings/index.html

@@ -14,8 +14,15 @@
   <!-- App Users -->
   <div class="col-md-7">
     <div class="card border-0 shadow-sm">
-      <div class="card-header bg-white fw-semibold py-3">
-        <i class="bi bi-person-gear me-2 text-primary"></i>Application Users
+      <div class="card-header bg-white fw-semibold py-3 d-flex align-items-center justify-content-between">
+        <span><i class="bi bi-person-gear me-2 text-primary"></i>Application Users</span>
+        {% if current_user.is_admin %}
+        <form method="POST" action="{{ url_for('settings.sync_from_portal') }}" class="d-inline">
+          <button type="submit" class="btn btn-sm btn-outline-primary">
+            <i class="bi bi-arrow-repeat me-1"></i>Sync from Portal
+          </button>
+        </form>
+        {% endif %}
       </div>
       <div class="table-responsive">
         <table class="table table-sm table-hover mb-0">