test: close the remaining FE/BE seams (WP-75)

Three seams WP-71 documented but left unguarded.

Deletes the FE's isHerregistratieEligible and isStatusConsistent — both
uncalled, the first dead by its own doc-comment. Their tests used fixtures
completely disjoint from the backend's (the backend even had an exact-window
boundary case the FE lacked), so the two sides could diverge indefinitely
without failing anything. CLAUDE.md's policy of keeping server-owned rules
as FE "reference impls" is what kept them alive, so it is amended: the FE may
mirror a server-supplied value for instant feedback, never reimplement the
algorithm. registration.policy.ts keeps its three live exports.

check-seam.sh now also guards the Besluit tag list — the C# enum and the TS
BESLUIT_TAGS array are identical ordered name lists with nothing linking
them, and Enum.TryParse fails at request time rather than build time. Anchored
on the full declaration so it avoids the "greps all matches" trap WP-69 hit.

The phone-format divergence turned out to be real, not latent as recorded:
the backend returned 422 for +31612345678 and (06) 12345678, both of which
the FE's own parseTelefoonnummer accepts. A grep check would have compared
the shared ^0\d{9}$ regex and reported all clear — the difference was in
stripping. RejectPhoneChange now strips what the FE strips, pinned by a
contract test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/reference/architecture/0001-bff-lite-decision-dtos.md

@@ -87,8 +87,8 @@ would compute. Two slices were implemented to demonstrate **both** policy shapes
 - `BigProfileStore` now derives `profile` and `decisions` from the single
   validated view (was a 3-resource `map2`). One request → one consistent snapshot.
 - `herregistratie.page.ts` reads `decisions.eligibleForHerregistratie` instead of
-  calling `isHerregistratieEligible()`. That rule is now marked server-owned in
-  `registration.policy.ts` (kept as reference impl + unit test; FE no longer calls it).
+  computing it client-side. That rule is server-owned: it lives only in
+  `HerregistratieRule.cs`, with no FE mirror to drift from it (WP-75).
 - The unused upstream adapters/mocks (`brp.adapter.ts`, `registration.json`,
   `brp.json`) were deleted — those calls live behind the BFF now.
 
@@ -103,8 +103,10 @@ would compute. Two slices were implemented to demonstrate **both** policy shapes
 - `intake-wizard.component.ts` fetches the policy and dispatches `SetPolicy`.
 - WP-69: the backend re-validates the threshold as the authority on submit —
   `IntakePolicy.RejectIncompleteScholing` runs before `POST /applications/{id}/submit`
-  (intake-typed) and the legacy `POST /intakes` write anything, 400ing an incomplete
-  scholing answer instead of silently accepting a crafted POST that skips it.
+  (intake-typed) writes anything, 400ing an incomplete scholing answer instead of
+  silently accepting a crafted POST that skips it. (WP-72 deleted the legacy
+  `POST /intakes` endpoint this once also covered — deleting the surface is a stronger
+  fix than 400ing on it.)
 
 ## Migration sequence (for the real app)