feat(dashboard): admin "Beheer" section linking the admin pages

Add a capability-gated Beheer section to the dashboard listing the admin pages
(Huisstijl, Stamdata, Aanvragen), each shown when the principal holds its
capability — so admin pages are discoverable, not URL-only. Extract the admin
link list to shared/layout/admin-links.ts as one source of truth, reused by the
site header (was ADMIN_NAV_ITEMS) and the new section. Capability-gated, never
role-derived (PRD-0002).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/layout/admin-links.ts

@@ -0,0 +1,34 @@
+import { Capability } from '@shared/domain/capability';
+
+/** One admin page: its label, a short description, its route, and the capability that
+    gates it. Single source of truth for "which admin pages exist" — consumed by the site
+    header's admin nav AND the dashboard's Beheer section, both filtered by `AccessStore.can`.
+    Capability-gated, never role-derived (PRD-0002 §6): the FE only mirrors server-resolved
+    capabilities, so this stays correct when real authz replaces the X-Role stub. */
+export interface AdminLink {
+  readonly label: string;
+  readonly description: string;
+  readonly to: string;
+  readonly cap: Capability;
+}
+
+export const ADMIN_LINKS: readonly AdminLink[] = [
+  {
+    label: $localize`:@@header.nav.huisstijl:Huisstijl`,
+    description: $localize`:@@admin.link.huisstijl.desc:Organisatiesjablonen voor brieven beheren`,
+    to: '/brief/huisstijl',
+    cap: 'orgtemplate:edit',
+  },
+  {
+    label: $localize`:@@header.nav.stamdata:Stamdata`,
+    description: $localize`:@@admin.link.stamdata.desc:Business-tabellen onderhouden`,
+    to: '/beheer/stamdata',
+    cap: 'stamdata:edit',
+  },
+  {
+    label: $localize`:@@header.nav.zaken:Aanvragen`,
+    description: $localize`:@@admin.link.zaken.desc:Alle aanvragen bekijken en beheren`,
+    to: '/beheer/zaken',
+    cap: 'cases:manage',
+  },
+];