feat(backend): enforce the scholing threshold server-side (WP-69)

ADR-0001's own canonical "config value" example was unenforced: GET
/intake/policy echoed ScholingThreshold, but no request DTO carried a
scholing answer, so the server had nothing to re-validate. A crafted
POST could skip a requirement the wizard presents as mandatory.

IntakePolicy.RejectIncompleteScholing is the authority — three-valued
completeness (below threshold an answer is required; "nee" is legal and
still submits; punten only belong to a followed scholing), living in the
class that owns the constant so scripts/check-seam.sh keeps guarding the
FE/BE literal pair. Both submit paths call it; a violation 400s with
ProblemDetails and leaves the aanvraag a Concept. Gated on
Type == "intake" (the endpoint's switch lumps herregistratie with
intake, which has no scholing question), and guarded by `reject is null`
so a zero-uren submission is still decided on its merits.

Also fixes a live FE bug in the same rule: validateStep required punten
whenever scholingGevolgd was 'ja' regardless of lageUren, while the
template renders those fields only when lageUren — so answering 'ja'
then raising uren either blocked the user on an invisible field or
emitted aanvullendeScholing: undefined alongside punten. punten now
derives from aanvullendeScholing, so that combination is unrepresentable
in ValidIntake.

Note: EndpointTests' Worked_hours_submission_succeeds was itself
asserting the vulnerable payload ({ uren: 40 }, no answer) and needed a
complete answer added; the zero-hours rows are the ordering regression
net and are unmodified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -75,7 +75,12 @@ public sealed record DocumentRefDto(string CategoryId, string Channel, string? D
 // Submit requests carry only the fields the server re-validates (UX-only fields
 // stay on the client). ponytail: a real submit would carry the full application.
 public sealed record RegistratieRequest(string DiplomaHerkomst, IReadOnlyList<DocumentRefDto>? Documents = null);
-public sealed record IntakeRequest(int Uren);
+
+// AanvullendeScholing/ScholingPunten (WP-69): the wizard's scholing answer, re-validated
+// server-side as the authority by IntakePolicy.RejectIncompleteScholing. Named
+// ScholingPunten (not Punten) — the sibling SubmitApplicationRequest is shared by all three
+// wizard types and the herregistratie wizard has its own unrelated `punten`.
+public sealed record IntakeRequest(int Uren, bool? AanvullendeScholing = null, int? ScholingPunten = null);
 public sealed record HerregistratieRequest(int Uren, IReadOnlyList<DocumentRefDto>? Documents = null);
 public sealed record ChangeRequestRequest(string Telefoon);
 
@@ -120,9 +125,12 @@ public sealed record DraftSyncRequest(
     IReadOnlyList<string>? DocumentIds = null);
 
 // Submit carries only the fields the server re-validates per wizard type.
+// AanvullendeScholing/ScholingPunten (WP-69) — see IntakeRequest; intake-typed aanvragen
+// only (gated by IntakePolicy.RejectIncompleteScholing's caller), null for the others.
 public sealed record SubmitApplicationRequest(
     string? DiplomaHerkomst = null, int? Uren = null,
-    IReadOnlyList<DocumentRefDto>? Documents = null);
+    IReadOnlyList<DocumentRefDto>? Documents = null,
+    bool? AanvullendeScholing = null, int? ScholingPunten = null);
 
 public sealed record SubmitApplicationResponse(string Referentie, AanvraagStatusDto Status);