IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

IT_asset_management/config.py

@@ -57,6 +57,9 @@ class Config:
     # Internal service-to-service sync secret — must match portal's INTERNAL_SYNC_SECRET
     INTERNAL_SYNC_SECRET = os.environ.get('INTERNAL_SYNC_SECRET', 'change-this-internal-secret')
 
+    # URL to reach the portal directly (bypassing nginx) for internal sync pulls
+    PORTAL_INTERNAL_URL = os.environ.get('PORTAL_INTERNAL_URL', 'http://localhost:5001')
+
     # Pagination
     ITEMS_PER_PAGE = int(os.environ.get('ITEMS_PER_PAGE', 25))