feat(dashboard): admin "Beheer" section linking the admin pages

Add a capability-gated Beheer section to the dashboard listing the admin pages
(Huisstijl, Stamdata, Aanvragen), each shown when the principal holds its
capability — so admin pages are discoverable, not URL-only. Extract the admin
link list to shared/layout/admin-links.ts as one source of truth, reused by the
site header (was ADMIN_NAV_ITEMS) and the new section. Capability-gated, never
role-derived (PRD-0002).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/registratie/ui/dashboard.page.ts

@@ -10,6 +10,8 @@ import { TaskListComponent } from '@shared/ui/task-list/task-list.component';
 import { ApplicationListComponent } from '@shared/ui/application-list/application-list.component';
 import { ApplicationLinkComponent } from '@shared/ui/application-link/application-link.component';
 import { ASYNC } from '@shared/ui/async/async.component';
+import { AccessStore } from '@shared/application/access.store';
+import { ADMIN_LINKS } from '@shared/layout/admin-links';
 import { RegistrationSummaryComponent } from '@registratie/ui/registration-summary/registration-summary.component';
 import { RegistrationTableComponent } from '@registratie/ui/registration-table/registration-table.component';
 import { AanvraagBlockComponent } from '@registratie/ui/aanvraag-block/aanvraag-block.component';
@@ -185,6 +187,22 @@ import { tasksFromProfile } from '@registratie/domain/tasks';
             }
           </app-application-list>
         </section>
+
+        @if (adminLinks().length) {
+          <section>
+            <app-heading [level]="2" i18n="@@dashboard.beheer">Beheer</app-heading>
+            <app-application-list class="app-section">
+              @for (link of adminLinks(); track link.to) {
+                <li
+                  app-application-link
+                  [heading]="link.label"
+                  [subtitle]="link.description"
+                  [to]="link.to"
+                ></li>
+              }
+            </app-application-list>
+          </section>
+        }
       </div>
     </app-page-shell>
   `,
@@ -192,8 +210,13 @@ import { tasksFromProfile } from '@registratie/domain/tasks';
 export class DashboardPage {
   protected store = inject(BigProfileStore);
   private apps = inject(ApplicationsStore);
+  private access = inject(AccessStore);
   private router = inject(Router);
 
+  /** Admin pages the current principal may reach — capability-gated (never role-derived),
+      the same source + filter the site header uses. Empty for a non-admin → section hidden. */
+  protected adminLinks = computed(() => ADMIN_LINKS.filter((l) => this.access.can(l.cap)));
+
   /** Pure view mapping for a submitted aanvraag → CIBG aanvragen-row fields. */
   protected submittedRow = submittedRow;