feat(backend): enforce the scholing threshold server-side (WP-69)

ADR-0001's own canonical "config value" example was unenforced: GET
/intake/policy echoed ScholingThreshold, but no request DTO carried a
scholing answer, so the server had nothing to re-validate. A crafted
POST could skip a requirement the wizard presents as mandatory.

IntakePolicy.RejectIncompleteScholing is the authority — three-valued
completeness (below threshold an answer is required; "nee" is legal and
still submits; punten only belong to a followed scholing), living in the
class that owns the constant so scripts/check-seam.sh keeps guarding the
FE/BE literal pair. Both submit paths call it; a violation 400s with
ProblemDetails and leaves the aanvraag a Concept. Gated on
Type == "intake" (the endpoint's switch lumps herregistratie with
intake, which has no scholing question), and guarded by `reject is null`
so a zero-uren submission is still decided on its merits.

Also fixes a live FE bug in the same rule: validateStep required punten
whenever scholingGevolgd was 'ja' regardless of lageUren, while the
template renders those fields only when lageUren — so answering 'ja'
then raising uren either blocked the user on an invisible field or
emitted aanvullendeScholing: undefined alongside punten. punten now
derives from aanvullendeScholing, so that combination is unrepresentable
in ValidIntake.

Note: EndpointTests' Worked_hours_submission_succeeds was itself
asserting the vulnerable payload ({ uren: 40 }, no answer) and needed a
complete answer added; the zero-hours rows are the ordering regression
net and are unmodified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/README.md

@@ -59,7 +59,7 @@ cd backend && dotnet test      # rule unit tests + endpoint integration tests
 | GET | `/api/intake/policy` | scholing threshold (config value) |
 | POST | `/api/registrations` | submit registration → reference, or 422 (manual diploma) |
 | POST | `/api/herregistraties` | submit re-registration → reference, or 422 (0 hours) |
-| POST | `/api/intakes` | submit intake → reference, or 422 (0 hours) |
+| POST | `/api/intakes` | submit intake → reference, or 422 (0 hours) / 400 (incomplete scholing answer) |
 
 Rejections use **ProblemDetails (RFC 7807)** with status **422**. Every request
 carries an `X-Correlation-Id` (set by the FE fetch adapter); the backend echoes it
@@ -77,7 +77,8 @@ semantics) is introduced as **`/api/v2`** served alongside v1 until clients migr
 
 - `Diplomas/DiplomaRules.cs` — profession derivation + which policy questions apply.
 - `Registrations/HerregistratieRule.cs` — eligibility + reason + status invariant.
-- `Intake/IntakePolicy.cs` — scholing threshold.
+- `Intake/IntakePolicy.cs` — scholing threshold + completeness re-validation on submit
+  (`RejectIncompleteScholing`, WP-69).
 - `Submissions/SubmissionRules.cs` — submit rejections + reference generation.
 
 ## Typed client (NSwag)