IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

portal/app/routes/api.py

@@ -106,3 +106,35 @@ def nv_users_internal():
             'nv_role':     nv_access.app_role or u.role,  # per-app override or portal role
         })
     return jsonify(result)
+
+
+@bp.route('/internal/itassets-users')
+def itassets_users_internal():
+    """
+    Internal endpoint for the IT Asset Management app to pull all portal users
+    that have itassets access, with their effective role.
+    Protected by X-Internal-Token header (shared INTERNAL_SYNC_SECRET).
+    """
+    secret = current_app.config.get('INTERNAL_SYNC_SECRET', '')
+    provided = request.headers.get('X-Internal-Token', '')
+    if not secret or not provided or not _secrets.compare_digest(provided, secret):
+        return jsonify({'error': 'forbidden'}), 403
+
+    from app.models.user import PortalUser
+    from app.models.app_access import AppAccess
+
+    users = PortalUser.query.filter_by(is_active=True).order_by(PortalUser.username).all()
+    result = []
+    for u in users:
+        access = AppAccess.query.filter_by(
+            user_id=u.id, app_name='itassets', is_active=True
+        ).first()
+        if access is None:
+            continue
+        result.append({
+            'username':    u.username,
+            'email':       u.email,
+            'portal_role': u.role,
+            'app_role':    access.app_role or u.role,
+        })
+    return jsonify(result)