Centralize client portal access checks through contactCan()

Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.

client/file.php

@@ -17,7 +17,7 @@ require_once 'functions.php';
 
 // Documents section is for primary / technical contacts only -
 // same gate as client/document.php
-if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
+if (!contactCan('itdoc')) {
     http_response_code(404);
     exit("File not found");
 }