PR 1 of 3 from the user-menu / profile / cross-app-link chantier.
* New `UserMenu` standalone component in `libs/shared/ui`. Avatar
trigger + CDK menu panel (gitea / github shape) — "Signed in as"
header, configurable rows (Profile, Settings — marked Soon),
separator, dedicated Sign out row at the bottom. Keyboard nav,
ARIA, and overlay portal handled by `@angular/cdk/menu`, same
primitives the theme + locale switchers already use.
* Each app's header consumes the shared component for the
authenticated state. The loading / anonymous / error widgets stay
app-local because they diverge by surface (portal-shell has a
search bar + notification cluster, portal-admin is leaner).
* Portal-shell anonymous Sign-in button moves from `rounded-full` to
`rounded-md`. The loading + error chips follow for visual
consistency with the new square-ish avatar.
* Portal-admin overrides the shared `--user-menu-avatar-bg` CSS
custom property to a translucent white so the avatar reads on
the brand-primary-600 header background.
Out of scope for this PR (covered by PR 2 + 3 of the chantier):
profile pages, real roles surfaced on portal-shell, cross-app
links between the two surfaces. The user menu's `items` input is
designed to absorb those additions without touching the component.
i18n: 6 new strings added to `messages.fr.xlf` for portal-shell.
portal-admin labels stay in English (no FR locale in the admin
app's v1 per ADR-0020 §"No locale switcher in v1").
Julien Gautier