feat(arch): WP-38 — dependency graph + declarative boundaries (dependency-cruiser)

Adopt dependency-cruiser as the single declarative source for bounded-context +
atomic-layer boundaries, replacing the per-context no-restricted-imports blocks that
had to be hand-copied (and had left herregistratie uncovered). `.dependency-cruiser.js`
encodes context direction (everyone→shared, herregistratie→registratie, showcase→*),
domain-purity, contracts-import-nothing, ui↛infrastructure, ApiClient confinement, and
no-circular. `npm run dep:check` enforces (wired into ci-local.sh + the frontend CI job);
`npm run dep:graph` emits a committed mermaid context×layer graph. ESLint slimmed to
no-explicit-any + template a11y. Docs + new-context skill updated to the single source.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

package.json

@@ -16,6 +16,8 @@
     "test-storybook": "test-storybook",
     "test-storybook:ci": "concurrently -k -s first -n sb,axe \"http-server storybook-static -p 6006 --silent\" \"wait-on tcp:127.0.0.1:6006 && test-storybook --url http://127.0.0.1:6006\"",
     "check:tokens": "bash scripts/check-tokens.sh",
+    "dep:check": "depcruise src/app --config .dependency-cruiser.js",
+    "dep:graph": "bash scripts/dep-graph.sh",
     "ci": "bash scripts/ci-local.sh",
     "e2e": "playwright test",
     "extract-i18n": "ng extract-i18n --output-path src/locale"
@@ -51,6 +53,7 @@
     "angular-eslint": "^22.0.0",
     "axe-playwright": "^2.2.2",
     "concurrently": "^10.0.3",
+    "dependency-cruiser": "^18.1.0",
     "eslint": "^10.6.0",
     "http-server": "^14.1.1",
     "jsdom": "^29.0.0",