Client Portal — Users

External users with access to the GJ client portal. Phase A: manage records + audit trail. Welcome-email + Cognito user creation ships in Phase B.