IT Assets: add role-based auth system and portal user sync

Auth:
- Fix local login (was redirecting to portal; now authenticates AdminUser directly)
- Portal SSO still takes priority in production via nginx headers

Role system (admin | editor | readonly):
- New app/utils/decorators.py with editor_required and admin_required decorators
- All write routes protected with editor_required (create/edit/delete/import/mask)
- Settings user management protected with admin_required
- Sidebar hides write-only links for readonly users
- Dashboard quick actions and list page buttons hidden for readonly

Settings page:
- Role colour badges (admin=red, editor=blue, readonly=grey)
- Inline role changer per user (dropdown auto-submit)
- Reset password modal per user
- Delete user button with confirmation
- Add user form includes role selector with legend

Portal user sync:
- New /internal/sync-user endpoint receives user pre-creation from portal
- INTERNAL_SYNC_SECRET added to config
- portal/config.py: added internal_url for itassets app so _sync_user_to_app works

IT_asset_management/app/templates/users/index.html

@@ -8,6 +8,7 @@
 {% block content %}
 <div class="page-header d-flex align-items-center justify-content-between mb-4">
   <h1><i class="bi bi-people-fill me-2"></i>Users</h1>
+  {% if current_user.is_editor %}
   <div class="d-flex gap-2">
     <a href="{{ url_for('users.import_page') }}" class="btn btn-outline-secondary btn-sm">
       <i class="bi bi-cloud-download me-1"></i>Import
@@ -16,6 +17,7 @@
       <i class="bi bi-person-plus me-1"></i>Add User
     </a>
   </div>
+  {% endif %}
 </div>
 
 <!-- Filters -->