Architect-review remediation: enforce conventions, prod-safe tooling, one form idiom, resilience seams

Acts on the showcase review. Four workstreams; all tests green
(npm run lint, 70 FE tests, ng build, 33 backend tests).

Enforcement + CI:
- eslint.config.mjs bans `any` and enforces layer/context boundaries
  (domain ≠ Angular; herregistratie → registratie → shared, auth → shared);
  `npm run lint` added; ajv 6 scoped to ESLint via nested override.
- .github/workflows/ci.yml: FE lint+check:tokens+test+build, backend dotnet test,
  and an API-client drift check.

One form idiom (the headline finding):
- change-request-form converged onto the wizard pattern — change-request.machine.ts
  (Model/Msg/reduce + value objects) + submit-change-request.ts (Result) + a real
  POST /api/v1/change-requests (server re-validates). Spec + story added; the detail
  page no longer holds an ad-hoc success signal.

Resilience/observability seam:
- api-client.provider.ts: request timeout, X-Correlation-Id, Idempotency-Key for
  writes; comments naming the retry/auth seams.
- Backend logs correlation id + a no-PII submit-audit line; /api/v1 prefix +
  backward-compat note; client regenerated.

Quick wins:
- Dev tooling excluded from prod: scenario.interceptor wired only under isDevMode()
  (?scenario= inert in prod); debug panel @if(isDev) (tree-shaken out).
- src/environments + apiBaseUrl into provideApiClient (angular.json fileReplacements).
- Backend /health + /health/ready.
- Debug view PII-minimised (redactProfile: name/address/DOB redacted, BIG masked).
- IntakePolicyAdapter (removes inline resource in the intake wizard).
- README de-staled; CLAUDE.md gains EN/NL + forms-one-idiom + lint/CI notes.
- Stories: text-input, link, data-row, site-header, site-footer, change-request-form.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/EndpointTests.cs

@@ -12,7 +12,7 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     [Fact]
     public async Task DashboardView_computes_eligibility_decision()
     {
-        var dto = await _client.GetFromJsonAsync<DashboardViewDto>("/api/dashboard-view");
+        var dto = await _client.GetFromJsonAsync<DashboardViewDto>("/api/v1/dashboard-view");
         Assert.NotNull(dto);
         Assert.Equal("19012345601", dto.Registration.BigNummer);
         Assert.Equal("Geregistreerd", dto.Registration.Status.Tag);
@@ -24,14 +24,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     [Fact]
     public async Task Notes_returns_seeded_aantekeningen()
     {
-        var notes = await _client.GetFromJsonAsync<List<AantekeningDto>>("/api/notes");
+        var notes = await _client.GetFromJsonAsync<List<AantekeningDto>>("/api/v1/notes");
         Assert.Equal(3, notes!.Count);
     }
 
     [Fact]
     public async Task Brp_returns_address()
     {
-        var dto = await _client.GetFromJsonAsync<BrpAddressDto>("/api/brp/address");
+        var dto = await _client.GetFromJsonAsync<BrpAddressDto>("/api/v1/brp/address");
         Assert.True(dto!.Gevonden);
         Assert.Equal("2514 EA", dto.Adres!.Postcode);
     }
@@ -39,7 +39,7 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     [Fact]
     public async Task Duo_lookup_carries_server_decided_questions_and_professions()
     {
-        var dto = await _client.GetFromJsonAsync<DuoLookupDto>("/api/duo/diplomas");
+        var dto = await _client.GetFromJsonAsync<DuoLookupDto>("/api/v1/duo/diplomas");
         Assert.NotNull(dto);
 
         var english = dto.Diplomas.Single(d => d.Id == "d2");
@@ -59,14 +59,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     [Fact]
     public async Task IntakePolicy_returns_scholing_threshold()
     {
-        var dto = await _client.GetFromJsonAsync<IntakePolicyDto>("/api/intake/policy");
+        var dto = await _client.GetFromJsonAsync<IntakePolicyDto>("/api/v1/intake/policy");
         Assert.Equal(1000, dto!.ScholingThreshold);
     }
 
     [Fact]
     public async Task Registration_with_duo_diploma_succeeds()
     {
-        var res = await _client.PostAsJsonAsync("/api/registrations", new RegistratieRequest("duo"));
+        var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("duo"));
         res.EnsureSuccessStatusCode();
         var body = await res.Content.ReadFromJsonAsync<ReferentieResponse>();
         Assert.StartsWith("BIG-2026-", body!.Referentie);
@@ -75,14 +75,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     [Fact]
     public async Task Registration_with_manual_diploma_is_rejected_with_problem_details()
     {
-        var res = await _client.PostAsJsonAsync("/api/registrations", new RegistratieRequest("handmatig"));
+        var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("handmatig"));
         Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
         Assert.Contains("application/problem+json", res.Content.Headers.ContentType!.ToString());
     }
 
     [Theory]
-    [InlineData("/api/intakes")]
-    [InlineData("/api/herregistraties")]
+    [InlineData("/api/v1/intakes")]
+    [InlineData("/api/v1/herregistraties")]
     public async Task Zero_hours_submission_is_rejected(string route)
     {
         var res = await _client.PostAsJsonAsync(route, new { uren = 0 });
@@ -90,11 +90,36 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
     }
 
     [Theory]
-    [InlineData("/api/intakes")]
-    [InlineData("/api/herregistraties")]
+    [InlineData("/api/v1/intakes")]
+    [InlineData("/api/v1/herregistraties")]
     public async Task Worked_hours_submission_succeeds(string route)
     {
         var res = await _client.PostAsJsonAsync(route, new { uren = 40 });
         res.EnsureSuccessStatusCode();
     }
+
+    [Fact]
+    public async Task Change_request_with_valid_address_succeeds()
+    {
+        var res = await _client.PostAsJsonAsync("/api/v1/change-requests",
+            new { straat = "Lange Voorhout 9", postcode = "2514 EA", woonplaats = "Den Haag" });
+        res.EnsureSuccessStatusCode();
+        var body = await res.Content.ReadFromJsonAsync<ReferentieResponse>();
+        Assert.StartsWith("BIG-2026-", body!.Referentie);
+    }
+
+    [Fact]
+    public async Task Change_request_with_bad_postcode_is_rejected()
+    {
+        var res = await _client.PostAsJsonAsync("/api/v1/change-requests",
+            new { straat = "Straat 1", postcode = "nope", woonplaats = "Den Haag" });
+        Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
+    }
+
+    [Fact]
+    public async Task Health_endpoint_is_ok()
+    {
+        var res = await _client.GetAsync("/health");
+        res.EnsureSuccessStatusCode();
+    }
 }

backend/tests/BigRegister.Tests/RuleTests.cs

@@ -114,4 +114,11 @@ public class SubmissionRuleTests
     [Fact]
     public void Worked_hours_are_accepted() =>
         Assert.Null(SubmissionRules.RejectZeroUren(40));
+
+    [Theory]
+    [InlineData("Lange Voorhout 9", "2514 EA", null)]   // valid
+    [InlineData("", "2514 EA", "Vul straat en huisnummer in.")]
+    [InlineData("Straat 1", "nope", "Voer een geldige postcode in, bijv. 1234 AB.")]
+    public void Change_request_is_validated(string straat, string postcode, string? expected) =>
+        Assert.Equal(expected, SubmissionRules.RejectChangeRequest(straat, postcode));
 }