IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

IT_asset_management/app/routes/settings.py

@@ -3,6 +3,7 @@ from flask_login import login_required, current_user
 from app.extensions import db
 from app.models.admin_user import AdminUser
 from app.utils.decorators import admin_required
+from app.utils.portal_sso import _portal_role_to_local
 
 bp = Blueprint('settings', __name__, url_prefix='/settings')
 
@@ -104,3 +105,63 @@ def delete_admin(admin_id):
     db.session.commit()
     flash(f'User "{username}" deleted.', 'success')
     return redirect(url_for('settings.index'))
+
+
+@bp.route('/sync-from-portal', methods=['POST'])
+@login_required
+@admin_required
+def sync_from_portal():
+    """Pull all portal users with itassets access and upsert them locally."""
+    import urllib.request
+    import json as _json
+
+    portal_url = current_app.config.get('PORTAL_INTERNAL_URL', 'http://localhost:5001')
+    secret = current_app.config.get('INTERNAL_SYNC_SECRET', '')
+    url = portal_url.rstrip('/') + '/api/internal/itassets-users'
+
+    try:
+        req = urllib.request.Request(
+            url,
+            headers={'X-Internal-Token': secret},
+            method='GET',
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            users = _json.loads(resp.read())
+    except Exception as exc:
+        flash(f'Could not reach portal: {exc}', 'danger')
+        return redirect(url_for('settings.index'))
+
+    created = updated = 0
+    for u in users:
+        username = u.get('username', '').strip()
+        email = u.get('email', '') or f'{username}@portal.local'
+        local_role = _portal_role_to_local(u.get('app_role', 'standard'))
+        if not username:
+            continue
+        existing = AdminUser.query.filter_by(username=username).first()
+        if existing:
+            changed = False
+            if existing.role != local_role:
+                existing.role = local_role
+                changed = True
+            if existing.email != email:
+                existing.email = email
+                changed = True
+            if changed:
+                updated += 1
+        else:
+            import secrets as _sec
+            new_user = AdminUser(
+                username=username,
+                email=email,
+                full_name=username,
+                role=local_role,
+                is_active=True,
+            )
+            new_user.set_password(_sec.token_hex(32))
+            db.session.add(new_user)
+            created += 1
+
+    db.session.commit()
+    flash(f'Portal sync complete — {created} created, {updated} updated.', 'success')
+    return redirect(url_for('settings.index'))