test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/behandelportal/src/app/behandeling/domain/besluit.machine.spec.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { expectTag } from '@shared/testing/expect-tag';
 import { BesluitState, reduce, initial } from './besluit.machine';
 
 const editingWith = (besluit: string, toelichting = ''): BesluitState => ({
@@ -10,26 +11,22 @@ const editingWith = (besluit: string, toelichting = ''): BesluitState => ({
 describe('besluit reduce', () => {
   it('SetField updates the draft while editing', () => {
     const s = reduce(initial, { tag: 'SetField', key: 'besluit', value: 'Goedkeuren' });
-    expect(s.tag).toBe('Editing');
-    expect((s as Extract<BesluitState, { tag: 'Editing' }>).draft.besluit).toBe('Goedkeuren');
+    expect(expectTag(s, 'Editing').draft.besluit).toBe('Goedkeuren');
   });
 
   it('Submit with no besluit chosen stays Editing and reports a field error', () => {
     const s = reduce(editingWith(''), { tag: 'Submit' });
-    expect(s.tag).toBe('Editing');
-    expect((s as Extract<BesluitState, { tag: 'Editing' }>).errors.besluit).toBeTruthy();
+    expect(expectTag(s, 'Editing').errors.besluit).toBeTruthy();
   });
 
   it('Submit Afwijzen without a toelichting stays Editing and reports a field error', () => {
     const s = reduce(editingWith('Afwijzen'), { tag: 'Submit' });
-    expect(s.tag).toBe('Editing');
-    expect((s as Extract<BesluitState, { tag: 'Editing' }>).errors.toelichting).toBeTruthy();
+    expect(expectTag(s, 'Editing').errors.toelichting).toBeTruthy();
   });
 
   it('Submit Goedkeuren with no toelichting moves to Submitting (optional there)', () => {
     const s = reduce(editingWith('Goedkeuren'), { tag: 'Submit' });
-    expect(s.tag).toBe('Submitting');
-    expect((s as Extract<BesluitState, { tag: 'Submitting' }>).data).toEqual({
+    expect(expectTag(s, 'Submitting').data).toEqual({
       besluit: 'Goedkeuren',
       toelichting: undefined,
     });
@@ -37,8 +34,7 @@ describe('besluit reduce', () => {
 
   it('Submit Afwijzen with a toelichting moves to Submitting with the trimmed value', () => {
     const s = reduce(editingWith('Afwijzen', '  niet erkend  '), { tag: 'Submit' });
-    expect(s.tag).toBe('Submitting');
-    expect((s as Extract<BesluitState, { tag: 'Submitting' }>).data).toEqual({
+    expect(expectTag(s, 'Submitting').data).toEqual({
       besluit: 'Afwijzen',
       toelichting: 'niet erkend',
     });