test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/Builders/AanvraagBuilder.cs

@@ -52,8 +52,16 @@ public sealed class ConceptAanvraag
   }
 
   /// The wizard's current position — step <paramref name="index"/> of <paramref name="of"/>.
+  /// Guarded the same way a real cursor is (`STEPS[Math.min(cursor, STEPS.length - 1)]` on the
+  /// frontend): <paramref name="of"/> must be at least 1, and <paramref name="index"/> must fall
+  /// within <c>[0, of)</c> — <c>AtStep(9, 2)</c> is not a position any real wizard can reach, so
+  /// the builder refuses it instead of silently building an impossible fixture.
   public ConceptAanvraag AtStep(int index, int of)
   {
+    if (of < 1)
+      throw new ArgumentOutOfRangeException(nameof(of), of, "Step count must be at least 1.");
+    if (index < 0 || index >= of)
+      throw new ArgumentOutOfRangeException(nameof(index), index, $"Step index must be within [0, {of}).");
     _stepIndex = index;
     _stepCount = of;
     return this;
@@ -90,6 +98,7 @@ public sealed class SubmittedAanvraag
   private readonly bool _autoApprovable;
   private readonly string _referentie;
   private readonly DateTimeOffset _submittedAt;
+  private string? _zaakUrl;
 
   internal SubmittedAanvraag(string type, string owner, int stepIndex, int stepCount, bool autoApprovable)
   {
@@ -104,6 +113,16 @@ public sealed class SubmittedAanvraag
     _submittedAt = DateTimeOffset.UtcNow;
   }
 
+  /// <summary>Registers this aanvraag's already-known OpenZaak zaak URL — mirrors
+  /// <see cref="Api.Data.ApplicationStore.SetZaakUrl"/>, the one production writer of this
+  /// field, so a fixture that needs a pre-existing zaak doesn't reach past <c>Build()</c> to
+  /// mutate the result by hand.</summary>
+  public SubmittedAanvraag WithZaakUrl(string zaakUrl)
+  {
+    _zaakUrl = zaakUrl;
+    return this;
+  }
+
   /// <summary>Records a behandelaar's decision — reusing <see cref="BeoordelingRules.RequiresToelichting"/>,
   /// the SAME rule production's besluit endpoint runs, rather than restating it here where it
   /// could quietly drift. Throws <see cref="ArgumentException"/> for an Afwijzen/MeerInfoOpvragen
@@ -129,6 +148,7 @@ public sealed class SubmittedAanvraag
     SubmittedAt = _submittedAt,
     CreatedAt = _submittedAt,
     UpdatedAt = _submittedAt,
+    ZaakUrl = _zaakUrl,
   };
 }