test: close illegal-state escape hatches in spec type-safety (WP-71)

ESLint blanket-exempted every *.spec.ts from the any ban, and no gate
type-checked spec files at all (ng test is transpile-only), so a wrong
cast in a test could never fail the build. 76 `as any` + 12 `as
Extract<>` state-narrowing casts in the three biggest wizard specs read
one variant's fields off a whole-union value: if the reducer returned
the wrong variant, the assertion silently read undefined instead of
failing.

expectTag(state, tag) (libs/shared/src/testing/expect-tag.ts) asserts
and narrows in one call, replacing every one of those casts. Removes
the spec-file any exemption, adds `npm run typecheck` (tsc --noEmit
over each project's tsconfig.spec.json) to CI, and forbids production
code from importing libs/shared/src/testing via dependency-cruiser.
Backend: AanvraagBuilder now models ZaakUrl (closing the last
post-Build() mutation) and guards AtStep; null-forgiving `!` on
endpoint assertions replaced with Assert.NotNull so a null DTO fails by
name, not NullReferenceException.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -4,6 +4,7 @@
   "scripts": {
     "ng": "ng",
     "lint": "eslint .",
+    "typecheck": "tsc --noEmit -p apps/ssp/tsconfig.spec.json --rootDir . && tsc --noEmit -p apps/behandelportal/tsconfig.spec.json --rootDir . && tsc --noEmit -p libs/shared/tsconfig.spec.json --rootDir . && tsc --noEmit -p libs/beheer/tsconfig.spec.json --rootDir .",
     "format:check": "prettier --check .",
     "format": "prettier --write .",
     "start": "ng serve ssp",
@@ -22,9 +23,11 @@
     "test-storybook:ci": "concurrently -k -s first -n sb,axe \"http-server storybook-static -p 6006 --silent\" \"wait-on tcp:127.0.0.1:6006 && test-storybook --config-dir .storybook-ssp --url http://127.0.0.1:6006 --maxWorkers=2\"",
     "test-storybook:ci:behandelportal": "concurrently -k -s first -n sb,axe \"http-server storybook-static-behandelportal -p 6007 --silent\" \"wait-on tcp:127.0.0.1:6007 && test-storybook --config-dir .storybook-behandelportal --url http://127.0.0.1:6007 --maxWorkers=2\"",
     "check:tokens": "bash scripts/check-tokens.sh",
+    "check:seam": "bash scripts/check-seam.sh",
     "dep:check": "depcruise apps/ssp/src libs --config .dependency-cruiser.ssp.js && depcruise apps/behandelportal/src libs --config .dependency-cruiser.behandelportal.js",
     "dep:graph": "bash scripts/dep-graph.sh",
     "gen:snippets": "node scripts/gen-snippets.mjs",
+    "gen:behaviour-spec": "node scripts/gen-behaviour-spec.mjs",
     "gen": "plop",
     "gen:value-object": "plop value-object",
     "gen:form-machine": "plop form-machine",