IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

IT_asset_management/app/templates/settings/index.html

@@ -14,8 +14,15 @@
   <!-- App Users -->
   <div class="col-md-7">
     <div class="card border-0 shadow-sm">
-      <div class="card-header bg-white fw-semibold py-3">
-        <i class="bi bi-person-gear me-2 text-primary"></i>Application Users
+      <div class="card-header bg-white fw-semibold py-3 d-flex align-items-center justify-content-between">
+        <span><i class="bi bi-person-gear me-2 text-primary"></i>Application Users</span>
+        {% if current_user.is_admin %}
+        <form method="POST" action="{{ url_for('settings.sync_from_portal') }}" class="d-inline">
+          <button type="submit" class="btn btn-sm btn-outline-primary">
+            <i class="bi bi-arrow-repeat me-1"></i>Sync from Portal
+          </button>
+        </form>
+        {% endif %}
       </div>
       <div class="table-responsive">
         <table class="table table-sm table-hover mb-0">