feat(brief): locked sections, list formatting, auto/manual placeholder chips

- brief.machine: reducer refuses edits to locked (predefined) sections as
  defense-in-depth; LetterSection gains a `locked` flag
- rich-text: paragraphs gain optional `list` kind; editor gets bullet/numbered
  list buttons, keyboard shortcuts, and backspace-deletes-adjacent-chip
- placeholder chips distinguish auto-resolvable (grey) vs manual (yellow), in
  both the editor and the read-only preview
- fix: preview chip now renders matching {…} braces (was a one-sided ⌗ glyph),
  aligned with the editor's chip styling

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -115,7 +115,8 @@ public sealed record SubmitApplicationResponse(string Referentie, AanvraagStatus
 // rich-text semantics and re-validates at its parse* boundary.
 
 public sealed record RichTextNodeDto(string Type, string? Text = null, IReadOnlyList<string>? Marks = null, string? Key = null);
-public sealed record ParagraphDto(IReadOnlyList<RichTextNodeDto> Nodes);
+// List is null for a plain paragraph, "bullet" or "number" for a list item.
+public sealed record ParagraphDto(IReadOnlyList<RichTextNodeDto> Nodes, string? List = null);
 public sealed record RichTextBlockDto(IReadOnlyList<ParagraphDto> Paragraphs);
 
 public sealed record PlaceholderDefDto(string Key, string Label, bool AutoResolvable, bool? Fillable = null, bool? Deprecated = null);
@@ -125,7 +126,8 @@ public sealed record LetterBlockDto(
     string Type, string BlockId, RichTextBlockDto Content,
     string? SourcePassageId = null, int? SourceVersion = null, bool? Edited = null);
 
-public sealed record LetterSectionDto(string SectionKey, string Title, bool Required, IReadOnlyList<LetterBlockDto> Blocks);
+// Locked sections (aanhef, slot) are predefined template text the drafter cannot edit.
+public sealed record LetterSectionDto(string SectionKey, string Title, bool Required, IReadOnlyList<LetterBlockDto> Blocks, bool Locked = false);
 
 // BriefStatus union, flattened by Tag (draft | submitted | approved | rejected | sent).
 public sealed record BriefStatusDto(

backend/src/BigRegister.Api/Data/BriefStore.cs

@@ -95,6 +95,19 @@ public static class BriefStore
         lock (_gate) _byOwner.Clear();
     }
 
+    /// Demo affordance: drop the owner's brief and create a fresh one. No guards — a
+    /// "start over" for the showcase, not a real workflow transition.
+    public static BriefEntity ResetAndCreate(string owner)
+    {
+        lock (_gate)
+        {
+            _byOwner.Remove(owner);
+            var created = BriefSeed.NewBrief(owner);
+            _byOwner[owner] = created;
+            return created;
+        }
+    }
+
     // Approve/reject share the guard: must be submitted, and the approver must differ
     // from the drafter (a drafter cannot approve their own letter).
     private static (Outcome, BriefEntity?) Review(string owner, string actingId, Func<BriefEntity, BriefStatusDto> next)
@@ -142,11 +155,20 @@ public static class BriefSeed
         TemplateId = TemplateId,
         DrafterId = BriefStore.DrafterId,
         Placeholders = Placeholders,
+        // aanhef + slot are predefined, locked template text (prefilled); the drafter
+        // composes only the unlocked `kern`. Save trusts the FE not to mutate locked
+        // sections (FE-authoritative for this POC — the FE reducer also refuses it).
         Sections = new()
         {
-            new("aanhef", "Aanhef", true, new List<LetterBlockDto>()),
+            new("aanhef", "Aanhef", true, new List<LetterBlockDto>
+            {
+                new("freeText", "aanhef-1", Block(T("Geachte heer/mevrouw "), P("naam_zorgverlener"), T(","))),
+            }, Locked: true),
             new("kern", "Kern van het besluit", true, new List<LetterBlockDto>()),
-            new("slot", "Slot", false, new List<LetterBlockDto>()),
+            new("slot", "Slot", false, new List<LetterBlockDto>
+            {
+                new("freeText", "slot-1", Block(T("Met vriendelijke groet,"))),
+            }, Locked: true),
         },
         Status = new BriefStatusDto("draft"),
     };

backend/src/BigRegister.Api/Program.cs

@@ -304,6 +304,15 @@ api.MapPost("/brief/send", () =>
 .Produces<BriefDto>()
 .ProducesProblem(StatusCodes.Status409Conflict);
 
+api.MapPost("/brief/reset", () =>
+{
+    // Demo "start over": recreate a fresh draft. No guards — showcase affordance only.
+    var e = BriefStore.ResetAndCreate(DocumentStore.DemoOwner);
+    return new BriefViewDto(e.ToDto(), BriefSeed.PassagesFor(e.Beroep));
+})
+.WithName("briefReset")
+.Produces<BriefViewDto>();
+
 app.Run();
 
 static bool IsAdmin(HttpContext ctx) => ctx.Request.Headers["X-Admin"] == "true";

backend/swagger.json

@@ -863,6 +863,26 @@
           }
         }
       }
+    },
+    "/api/v1/brief/reset": {
+      "post": {
+        "tags": [
+          "BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
+        ],
+        "operationId": "briefReset",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BriefViewDto"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   "components": {
@@ -1389,6 +1409,9 @@
               "$ref": "#/components/schemas/LetterBlockDto"
             },
             "nullable": true
+          },
+          "locked": {
+            "type": "boolean"
           }
         },
         "additionalProperties": false
@@ -1455,6 +1478,10 @@
               "$ref": "#/components/schemas/RichTextNodeDto"
             },
             "nullable": true
+          },
+          "list": {
+            "type": "string",
+            "nullable": true
           }
         },
         "additionalProperties": false

backend/tests/BigRegister.Tests/BriefEndpointTests.cs

@@ -49,7 +49,14 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
         var brief = await Get();
         Assert.Equal("draft", brief.Status.Tag);
         Assert.Equal(new[] { "aanhef", "kern", "slot" }, brief.Sections.Select(s => s.SectionKey));
-        Assert.All(brief.Sections, s => Assert.Empty(s.Blocks));
+        // aanhef + slot are locked, predefined and prefilled; only kern is editable + empty.
+        var aanhef = brief.Sections.Single(s => s.SectionKey == "aanhef");
+        Assert.True(aanhef.Locked);
+        Assert.NotEmpty(aanhef.Blocks);
+        Assert.True(brief.Sections.Single(s => s.SectionKey == "slot").Locked);
+        var kern = brief.Sections.Single(s => s.SectionKey == "kern");
+        Assert.False(kern.Locked);
+        Assert.Empty(kern.Blocks);
 
         var view = await _client.GetFromJsonAsync<BriefViewDto>("/api/v1/brief");
         // global passages + the arts-scoped one; no other-beroep passages leak in.
@@ -134,4 +141,22 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
         res.EnsureSuccessStatusCode();
         Assert.Equal("sent", (await res.Content.ReadFromJsonAsync<BriefDto>())!.Status.Tag);
     }
+
+    [Fact]
+    public async Task Reset_recreates_a_fresh_draft_with_locked_prefilled_sections()
+    {
+        var brief = await Get();
+        // Advance out of draft so the reset back to draft is observable.
+        await _client.PutAsJsonAsync("/api/v1/brief", FilledFrom(brief));
+        await _client.SendAsync(Post("/api/v1/brief/submit"));
+
+        var res = await _client.SendAsync(Post("/api/v1/brief/reset"));
+        res.EnsureSuccessStatusCode();
+        var view = await res.Content.ReadFromJsonAsync<BriefViewDto>();
+        Assert.Equal("draft", view!.Brief.Status.Tag);
+        var aanhef = view.Brief.Sections.Single(s => s.SectionKey == "aanhef");
+        Assert.True(aanhef.Locked);
+        Assert.NotEmpty(aanhef.Blocks);
+        Assert.Empty(view.Brief.Sections.Single(s => s.SectionKey == "kern").Blocks);
+    }
 }