test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/herregistratie/domain/intake-has-progress.spec.ts

@@ -1,15 +1,26 @@
 import { describe, it, expect } from 'vitest';
-import { hasProgress, initial, IntakeState } from './intake.machine';
+import { given } from '@shared/testing/machine';
+import { expectTag } from '@shared/testing/expect-tag';
+import { hasProgress, initial, reduce } from './intake.machine';
 
-const answering = initial as Extract<IntakeState, { tag: 'Answering' }>;
+const intake = given(reduce, initial);
 
 describe('intake hasProgress', () => {
   it('is false for a fresh questionnaire', () => {
-    expect(hasProgress(answering)).toBe(false);
+    expect(hasProgress(expectTag(initial, 'Answering'))).toBe(false);
   });
 
   it('is true once an answer is given or the user advances', () => {
-    expect(hasProgress({ ...answering, answers: { buitenlandGewerkt: 'ja' } })).toBe(true);
-    expect(hasProgress({ ...answering, cursor: 1 })).toBe(true);
+    const answered = expectTag(
+      intake({ tag: 'SetAnswer', key: 'buitenlandGewerkt', value: 'ja' }),
+      'Answering',
+    );
+    expect(hasProgress(answered)).toBe(true);
+
+    const advanced = expectTag(
+      intake({ tag: 'SetAnswer', key: 'buitenlandGewerkt', value: 'nee' }, { tag: 'Next' }),
+      'Answering',
+    );
+    expect(hasProgress(advanced)).toBe(true);
   });
 });