IT Assets: add portal sync button + wire env vars in start-dev.sh

- Portal: add /api/internal/itassets-users endpoint (returns all portal users
  with itassets access + their effective role)
- IT Assets: add PORTAL_INTERNAL_URL config key
- IT Assets: add POST /settings/sync-from-portal route (admin only) — pulls
  users from the portal API and upserts them locally
- Settings page: 'Sync from Portal' button next to the users table header
- start-dev.sh: pass INTERNAL_SYNC_SECRET and ITASSETS_INTERNAL_URL to portal;
  pass PORTAL_INTERNAL_URL and INTERNAL_SYNC_SECRET to itassets
- Also includes 'Back to Portal' icon button added to sidebar footer

start-dev.sh

@@ -383,6 +383,8 @@ start_bg "portal" \
     env FLASK_ENV=development \
         DATA_DIR="$ROOT/portal/data" \
         PORT=$PORTAL_PORT \
+        INTERNAL_SYNC_SECRET="${INTERNAL_SYNC_SECRET:-change-this-internal-secret}" \
+        ITASSETS_INTERNAL_URL="http://127.0.0.1:${ITASSETS_PORT}" \
     "$ROOT/portal/.venv/bin/python" "$ROOT/portal/run.py"
 
 # DigiServer
@@ -414,6 +416,8 @@ if module_enabled "itassets"; then
             PORTAL_JWT_SECRET=change-this-jwt-secret-in-production \
             PORTAL_LOGIN_URL="http://localhost:${NGINX_PORT}/login" \
             PORTAL_LOGOUT_URL="http://localhost:${NGINX_PORT}/logout" \
+            PORTAL_INTERNAL_URL="http://127.0.0.1:${PORTAL_PORT}" \
+            INTERNAL_SYNC_SECRET="${INTERNAL_SYNC_SECRET:-change-this-internal-secret}" \
             FLASK_APP=run.py \
         "$ROOT/IT_asset_management/.venv/bin/python" "$ROOT/IT_asset_management/run.py"
 else