feat(hr): Complete HR module with Employee Portal, Loans, Leave, Purchase Requests, Contracts

- Database: Add Loan, LoanInstallment, PurchaseRequest, LeaveEntitlement, EmployeeContract models
- Database: Extend Attendance with ZK Tico fields (sourceDeviceId, externalId, rawData)
- Database: Add Employee.attendancePin for device mapping
- Backend: HR admin - Loans, Purchase Requests, Leave entitlements, Employee contracts CRUD
- Backend: Leave reject, bulk attendance sync (ZK Tico ready)
- Backend: Employee Portal API - scoped by employeeId (loans, leaves, purchase-requests, attendance, salaries)
- Frontend: Employee Portal - dashboard, loans, leave, purchase-requests, attendance, salaries
- Frontend: HR Admin - new tabs for Leaves, Loans, Purchase Requests, Contracts (approve/reject)
- Dashboard: Add My Portal link
- No destructive schema changes; additive migrations only

Made-with: Cursor

frontend/src/app/dashboard/page.tsx

@@ -8,6 +8,7 @@ import LanguageSwitcher from '@/components/LanguageSwitcher'
 import Link from 'next/link'
 import {
   Users,
+  User,
   TrendingUp,
   Package,
   CheckSquare,
@@ -85,6 +86,16 @@ function DashboardContent() {
       description: 'الموظفين والإجازات والرواتب',
       permission: 'hr'
     },
+    {
+      id: 'portal',
+      name: 'البوابة الذاتية',
+      nameEn: 'My Portal',
+      icon: User,
+      color: 'bg-cyan-500',
+      href: '/portal',
+      description: 'قروضي، إجازاتي، طلبات الشراء والرواتب',
+      permission: 'hr'
+    },
     {
       id: 'marketing',
       name: 'التسويق',