feat(arch): WP-38 — dependency graph + declarative boundaries (dependency-cruiser)

Adopt dependency-cruiser as the single declarative source for bounded-context +
atomic-layer boundaries, replacing the per-context no-restricted-imports blocks that
had to be hand-copied (and had left herregistratie uncovered). `.dependency-cruiser.js`
encodes context direction (everyone→shared, herregistratie→registratie, showcase→*),
domain-purity, contracts-import-nothing, ui↛infrastructure, ApiClient confinement, and
no-circular. `npm run dep:check` enforces (wired into ci-local.sh + the frontend CI job);
`npm run dep:graph` emits a committed mermaid context×layer graph. ESLint slimmed to
no-explicit-any + template a11y. Docs + new-context skill updated to the single source.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/dep-graph.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Regenerate the architecture dependency graph (WP-38) as a mermaid diagram embedded in a
+# markdown file, so it renders on the git host and can be linked from the docs. Contexts ×
+# atomic layers; edges are real imports. Boundaries are enforced separately by `npm run
+# dep:check`. Run this after a structural change; commit the result.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+OUT=docs/reference/architecture/dependency-graph.md
+
+{
+  echo "# Dependency graph"
+  echo
+  echo "_Generated by \`npm run dep:graph\` — do not edit by hand._ Nodes are context × atomic"
+  echo "layer (\`src/app/<context>/<layer>\`); edges are real imports. The allowed edges are"
+  echo "enforced by \`npm run dep:check\` (dependency-cruiser); see [dependencies.md](./dependencies.md)."
+  echo
+  echo '```mermaid'
+  npx depcruise src/app \
+    --config .dependency-cruiser.js \
+    --include-only "^src/app/" \
+    --collapse "^src/app/[^/]+/[^/]+" \
+    --output-type mermaid
+  echo '```'
+} >"$OUT"
+
+echo "wrote $OUT"