test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/testing/expect-tag.ts

@@ -0,0 +1,17 @@
+/**
+ * Assert-and-narrow a tagged-union state to one specific variant, replacing the
+ * `(state as any).field` / `state as Extract<S, { tag: 'X' }>` casts specs used
+ * to reach into a machine's state. A cast only *tells* the type checker the
+ * variant — it performs no runtime check, so a spec written against the wrong
+ * variant silently reads `undefined` off a field that doesn't exist on the
+ * actual state and, depending on the assertion, can still pass. `expectTag`
+ * throws immediately if the tag doesn't match, so a wrong-variant read fails
+ * loudly at the point of the mistake instead of surviving as a green test.
+ */
+export const expectTag = <S extends { tag: string }, T extends S['tag']>(
+  s: S,
+  tag: T,
+): Extract<S, { tag: T }> => {
+  if (s.tag !== tag) throw new Error(`expected state '${tag}', got '${s.tag}'`);
+  return s as Extract<S, { tag: T }>;
+};