feat(admin): runtime feature flags (catalog-in-code, admin toggle, FE+backend)

Catalog declared in code (Domain/Features/FeatureFlags.cs, build-validated), on/off state
persisted in SQLite (FeatureFlagStore + migration). GET /flags (drives FE gating) + admin
PUT /admin/flags/{key} (new flags:manage capability + FlagsAdmin gate). Enforced end-to-end:
the `inschrijving-open` flag hides the Inschrijven nav item + dashboard action (FE) AND makes
POST /applications for a registratie 403 when off (backend). FE FeatureFlagStore mirrors
AccessStore (enabled() deny-by-default); admin toggle page at /beheer/functies in ADMIN_LINKS.
+4 backend tests, /me cap-list updated, client regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/application/feature-flags.store.ts

@@ -0,0 +1,58 @@
+import { Injectable, computed, inject, signal } from '@angular/core';
+import { RemoteData } from '@shared/application/remote-data';
+import { FeatureFlag } from '@shared/domain/feature-flag';
+import { FeatureFlagsAdapter, parseFlags } from '@shared/infrastructure/feature-flags.adapter';
+
+type Err = Error | undefined;
+
+/**
+ * Runtime feature-flag state (WP-47) — one root singleton, mirroring `AccessStore`. Loads the
+ * resolved flag set once from `GET /flags`; `enabled(key)` gates a feature (deny-by-default:
+ * false until loaded / unknown key). `set()` is the admin toggle (PUT + reload). The catalog is
+ * server-owned; the FE only mirrors + renders it.
+ */
+@Injectable({ providedIn: 'root' })
+export class FeatureFlagStore {
+  private adapter = inject(FeatureFlagsAdapter);
+  private state = signal<RemoteData<Err, FeatureFlag[]>>({ tag: 'Loading' });
+
+  readonly flags = this.state.asReadonly();
+  /** The resolved list (empty until loaded) — for the admin toggle UI. */
+  readonly all = computed(() => {
+    const rd = this.state();
+    return rd.tag === 'Success' ? rd.value : [];
+  });
+
+  constructor() {
+    void this.load();
+  }
+
+  async load() {
+    if (this.state().tag !== 'Success') this.state.set({ tag: 'Loading' });
+    try {
+      const parsed = parseFlags(await this.adapter.list());
+      this.state.set(
+        parsed.ok
+          ? { tag: 'Success', value: parsed.value }
+          : { tag: 'Failure', error: new Error(parsed.error) },
+      );
+    } catch (e) {
+      this.state.set({ tag: 'Failure', error: e as Error });
+    }
+  }
+
+  /** Deny-by-default: false while loading/failed or for an unknown key. Reactive (reads the signal). */
+  enabled(key: string): boolean {
+    const rd = this.state();
+    return rd.tag === 'Success' && (rd.value.find((f) => f.key === key)?.enabled ?? false);
+  }
+
+  /** Admin toggle: persist then reload so the state reflects the server. */
+  async set(key: string, enabled: boolean) {
+    try {
+      await this.adapter.set(key, enabled);
+    } finally {
+      await this.load();
+    }
+  }
+}