Matter files: portal for clients, workbench for lawyers

Every Project also has a matter file surface. Clients see it as Documents, Engagements, Invoices, and other plain-English portal views. If a person is added to a Project, Navigator can show them the client-facing files for that matter; if they are not added, those files do not exist from their portal's point of view.

Lawyer users have the firm workbench. Assigned lawyers work the Project through /lawyer. Admins are lawyer-tier users with installation-wide authority, so they can reach the same firm workbench without per-Project assignment. Clients never need that layer and never see the private GCS bucket behind the files.