feat(admin): runtime feature flags (catalog-in-code, admin toggle, FE+backend)

Catalog declared in code (Domain/Features/FeatureFlags.cs, build-validated), on/off state
persisted in SQLite (FeatureFlagStore + migration). GET /flags (drives FE gating) + admin
PUT /admin/flags/{key} (new flags:manage capability + FlagsAdmin gate). Enforced end-to-end:
the `inschrijving-open` flag hides the Inschrijven nav item + dashboard action (FE) AND makes
POST /applications for a registratie 403 when off (backend). FE FeatureFlagStore mirrors
AccessStore (enabled() deny-by-default); admin toggle page at /beheer/functies in ADMIN_LINKS.
+4 backend tests, /me cap-list updated, client regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/WP-47-feature-flags.md

@@ -0,0 +1,38 @@
+# WP-47 — Runtime feature flags (catalog-in-code, admin-toggled)
+
+Status: done
+Phase: 8 — platform/DX/showcase
+
+## Why
+
+Ops needs to turn features on/off at runtime without a deploy. Mirrors the two house templates: the
+capability spine (server-resolved, FE reads) and the org-template runtime-SQLite config (admin edits
+at runtime). Per ADR-0004 the **catalog** (which flags exist + defaults) is config-as-code; only the
+**on/off state** is runtime.
+
+## Decisions (locked with the user)
+
+- Catalog in code (typed, build-validated); on/off state in SQLite; admin toggles at runtime.
+- **FE + backend enforcement** — the FE hides the surface AND the server enforces (a flag can guard
+  a real feature, not just UI).
+
+## Outcome
+
+- Backend: `Domain/Features/FeatureFlags.cs` (catalog: one flag `inschrijving-open`, default on) +
+  `Data/FeatureFlagStore.cs` (`FeatureFlagEntity` in SQLite + migration; `All()` merges catalog
+  defaults with overrides, `IsEnabled`, `Set` rejects unknown keys). `GET /flags` (readable, drives
+  FE gating) + `PUT /admin/flags/{key}` (gated by new `flags:manage` cap + `FlagsAdmin`). Enforced
+  end-to-end: `POST /applications` for a `registratie` returns 403 when `inschrijving-open` is off.
+- FE: `shared/domain/feature-flag.ts` + `feature-flags.adapter.ts` (parse boundary) +
+  `shared/application/feature-flags.store.ts` (root singleton, `enabled(key)` deny-by-default,
+  `set`). Capability `flags:manage` (union + me.adapter + role.interceptor `/api/v1/admin/flags`).
+  The "Inschrijven" nav item + dashboard action hide when the flag is off. Admin toggle page
+  `beheer/ui/feature-flags.page.ts` at `/beheer/functies`, in `ADMIN_LINKS`.
+- Tests: catalog-unique + endpoint (admin-only toggle, 404 unknown key, close→403 / reopen→201).
+  `/me` cap-list test updated. Backend 136; typed client regenerated.
+
+## Acceptance criteria
+
+- [x] Admin toggles a flag at runtime; state persists (SQLite) and the whole app reads it.
+- [x] FE hides the flagged feature AND the backend enforces it (registration close → 403).
+- [x] `npm run ci` green (dep:check, localized build, backend `dotnet test`, drift clean after commit).