Step 2 (code quality): dedup + stop FE recomputing a server rule

- H1: tasksFromProfile takes the server's eligibleForHerregistratie decision
  instead of recomputing isHerregistratieEligible — the FE renders the rule,
  doesn't own it (ADR-0001). Policy reference impl kept for tests.
- M1: one shared runSubmit(fn, fallback) wrapper; the 4 submit-* commands keep
  only their payload mapping. +spec.
- M2: whenTag() kernel helper removes 10 repeated `as Extract<U,{tag}>` casts
  across the wizard/form components.

M4 (shared JA_NEE) folded into the upcoming i18n pass (clean dedup needs
$localize labels to sit in shared without breaking the English-shared-UI rule).
L1 already resolved by the restyle commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/kernel/fp.ts

@@ -21,3 +21,13 @@ export const err = <E>(error: E): Result<E, never> => ({ ok: false, error });
 /** Nominal typing: Brand<string, 'Postcode'> is assignable from a plain string
     only through an explicit cast — so a smart constructor is the only minter. */
 export type Brand<T, B extends string> = T & { readonly __brand: B };
+
+/** Narrow a tagged union to one variant by its `tag`, or null. The single place
+    the cast lives — TS can't narrow through a runtime tag argument, so callers get
+    `whenTag(state, 'Editing')?.foo` instead of repeating `as Extract<…>`. */
+export function whenTag<U extends { tag: string }, K extends U['tag']>(
+  u: U,
+  tag: K,
+): Extract<U, { tag: K }> | null {
+  return u.tag === tag ? (u as Extract<U, { tag: K }>) : null;
+}