feat(boundaries): WP-04 — ui ↛ infrastructure + showcase sanction

Move the two wizard lookups behind application-layer facades so ui/ no longer
injects infrastructure adapters directly:
- RegistratieLookupStore (BRP address + DUO diplomas): owns the resources,
  runs the trust-boundary parse, exposes adresStatus/prefillAdres/duoLookup.
- IntakePolicyStore (scholing threshold): owns the policy resource, exposes
  the derived threshold.

Add the lint rule ui/ + layout/ ↛ **/infrastructure/** (@typescript-eslint
variant so it composes with the base direction rules; stories/specs exempted
as test scaffolding). Add the documented showcase sanction (may read every
context). Fix the docs' inventory: 6 contexts / 5 layers, +brief, +contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -34,7 +34,8 @@ advisories are pinned via `package.json` `overrides`; the shipped bundle audits
 ### 1. DDD: contexts then layers, dependencies point inward
 
 `src/app/<context>/<layer>/`. Contexts: `shared`, `auth`, `registratie`,
-`herregistratie`, `showcase` (teaching page, not a feature).
+`herregistratie`, `brief` (letter-composition teaching slice), `showcase` (teaching
+page, not a feature; **sanctioned** to read every context — nothing imports it).
 
 | Layer             | Job                                       | Angular allowed?                 |
 | ----------------- | ----------------------------------------- | -------------------------------- |
@@ -45,9 +46,11 @@ advisories are pinned via `package.json` `overrides`; the shipped bundle audits
 | `ui/`             | how it looks (components, pages)          | yes                              |
 
 **Dependencies only point inward**: `ui → application → domain`; everyone may use
-`shared`; never the reverse. Cross-context only `herregistratie → registratie → shared`,
-`auth → shared`. Imports use aliases as direction statements: `@shared/* @auth/*
-@registratie/* @herregistratie/*`. `domain/` imports nothing from Angular.
+`shared`; never the reverse. `ui`/`layout` never import `infrastructure` directly
+(reach data through an application store/command) — lint-enforced. Cross-context only
+`herregistratie → registratie → shared`, `auth → shared`, `brief → shared`. Imports use
+aliases as direction statements: `@shared/* @auth/* @registratie/* @herregistratie/*
+@brief/*`. `domain/` imports nothing from Angular.
 
 ### 2. Atomic design: folder = layer