docs(adr): land ADR-C-001, ADR-C-003, ADR-C-007 and ADR-C-009

The architect approved the four ADR-fix tickets. All four change what the
architecture documents claim. No code changes.

ADR-0001, ADR-C-001: the worked example claimed the POC has no real backend.
It rewrites against `backend/src/BigRegister.Api`. Every path it named is
repointed. The out-of-scope list drops two discharged bullets: 33 `parse*`
boundaries exist, and `npm run gen:api` is real.

ADR-0001, ADR-C-003: a new section states that the generated client is the wire
contract. A hand-written `contracts/*.dto.ts` is the exception for two cases
only. The four survivors stay, because NSwag emits every property as optional
and flattens `RegistrationStatusDto` into five optional strings. The `parse*`
trust boundary stays mandatory, because a generated type is a compile-time
claim about the wire and not a runtime guarantee.

ADR-0003, ADR-C-007: four paths moved in WP-67 and are repointed. Point 4 kept
the principle and changed its example to `skeleton` and `spinner`. Two of its
claims were false and the amendment says so: `app-alert` wraps the vendored
`.feedback` classes, and `site-header` composes the vendored `.titlebar`.

ADR-0004, ADR-C-009: the exception section states a four-part test instead of
one named exception. `OrgTemplateStore` and `FeatureFlagStore` both pass it. RB-07
gated this ticket, because clause 4 needs an audited allow path. RB-07 landed
that, so the ADR does not ratify a control that the code lacks.

Three tickets need a matching CLAUDE.md correction in the same diff. CLAUDE.md
section 2 loses the false `alert` example. Section 4 gets the generated-client
rule and the four-part test.

Two findings were wrong. ADR-C-001 asked to keep an out-of-scope bullet that
reads "SessionStore is in-memory". The session persists to `localStorage` now,
so the bullet covers multi-tab sync only. ADR-C-007 flagged one half of point 4
and missed that the other half is equally false.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/project/refactor-backlog-setup/refactor-backlog/implementation/adr-c-007.md

@@ -0,0 +1,65 @@
+# ADR-C-007 — repoint ADR-0003's WP-67 paths and fix its point 4
+
+Status: **implemented** · 2026-08-27 · Source finding: `06-adr-conformance.md` §ADR-C-007
+
+## What was wrong
+
+Two separate defects in one ADR. Every file path in ADR-0003 predated WP-67's monorepo move,
+and decision point 4 made a claim about `app-alert` that the code contradicts.
+
+## What changed
+
+| File                                     | Change                                                                             |
+| ---------------------------------------- | ---------------------------------------------------------------------------------- |
+| `docs/reference/architecture/0003-...md` | points 1, 2, 4 and both §Consequences bullets rewritten                            |
+| `CLAUDE.md` §2                           | the `alert` parenthetical corrected to `skeleton`/`spinner` + a denial for `alert` |
+
+No code changed. ADR first, CLAUDE.md to match, one diff.
+
+## Paths, each verified
+
+| Claimed                  | Actual                                                                 |
+| ------------------------ | ---------------------------------------------------------------------- |
+| `src/styles.scss`        | `libs/shared/styles.scss` — one copy, both apps' `angular.json:41,169` |
+| `src/index.html`         | `apps/ssp/src/index.html` **and** `apps/behandelportal/src/index.html` |
+| `.storybook/`            | `.storybook-ssp/` and `.storybook-behandelportal/`                     |
+| `src/docs/cibg-gaps.mdx` | `libs/shared/docs/cibg-gaps.mdx`                                       |
+
+**One path in the finding's list needed no change.** ADR-C-007 implied point 1's
+`public/cibg-huisstijl/` had moved with the rest. It has not: `public/` is still at the repo
+root, and both apps' `angular.json` asset entries read `"input": "public"` (`:38`, `:166`).
+Both Storybook configs serve it as `staticDirs: ['../public']`. Point 1's vendoring path is
+left as written; only its `index.html` clause changed.
+
+## Point 4: the finding was right, and understated
+
+ADR-C-007 flagged the `.alert` half of point 4. Verified: `libs/shared/src/ui/alert/alert.component.ts`
+documents itself as a _"Thin wrapper over the vendored `.feedback feedback-*` classes"_, its
+template binds `.feedback-info/-success/-warning/-error`, its only local CSS is a 3-line flex
+fix, and it carries **no** `CIBG-GAP EXTENSION` marker. `grep` confirms `feedback-error` is
+present in `public/cibg-huisstijl/css/huisstijl.css` — the class is vendored, so `alert` is not
+a gap.
+
+**The finding missed that the same sentence's second claim is also false.** Point 4 said "the
+header/side-nav use `.nav` + a local blue bar". They do not:
+
+- `site-header.component.ts` composes the vendored `.titlebar` and `.logo__*` classes
+  (`grep` confirms `titlebar` in the vendored CSS) and its own comment says the titlebar
+  _"keeps its own robijn fill — `--ro-layout` — untouched"_.
+- `shell.component.ts` emits only `.layout`, `.main`, `.content`, `.skip` — page scaffolding.
+- No `.nav` class appears in either, and neither carries a gap marker.
+
+Both corrections are stated in the amended point 4 rather than silently dropped, so a reader
+comparing the old text against the code can see which claim was retired and why.
+
+## Replacement example chosen
+
+`skeleton` and `spinner`, as the finding proposed. Both are in the gap register, both carry
+markers reading "No loading-skeleton/spinner class in the vendored build", and both are
+genuinely absent — the cleanest live illustration of the principle point 4 exists to state.
+
+## Noted, not fixed: the gap register is still one row short
+
+`grep` finds **9** `CIBG-GAP EXTENSION` markers; `libs/shared/docs/cibg-gaps.mdx` has **8**
+rows. The missing one is `language-switcher`. That is **ADR-C-008 → RB-32** (batch 6), not
+this ticket, and it was left alone.