feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/registratie/application/big-profile.store.ts

@@ -0,0 +1,83 @@
+import { Injectable, computed, inject, signal } from '@angular/core';
+import { RemoteData, fromResource, map } from '@shared/application/remote-data';
+import { Aantekening } from '../domain/registration';
+import { BigProfile } from '../domain/big-profile';
+import { HerregistratieDecisions } from '../contracts/dashboard-view.dto';
+import { BigRegisterAdapter } from '../infrastructure/big-register.adapter';
+import {
+  DashboardView,
+  DashboardViewAdapter,
+  parseDashboardView,
+} from '../infrastructure/dashboard-view.adapter';
+
+type Err = Error | undefined;
+
+/**
+ * The single source of truth for the logged-in professional's profile, shared
+ * across pages (providedIn:'root' = one instance). It owns the httpResources
+ * (created here, in the required injection context) and exposes them as
+ * RemoteData signals.
+ *
+ * The dashboard data now comes from ONE screen-shaped ("BFF-lite") call that
+ * returns registration + person + server-computed `decisions`. One request → one
+ * consistent snapshot, instead of stitching three independently loading/erroring
+ * resources together client-side. See docs/reference/architecture/0001-bff-lite-decision-dtos.md.
+ */
+@Injectable({ providedIn: 'root' })
+export class BigProfileStore {
+  private big = inject(BigRegisterAdapter);
+  private viewAdapter = inject(DashboardViewAdapter);
+
+  private viewRes = this.viewAdapter.dashboardViewResource();
+  private aantekeningenRes = this.big.aantekeningenResource();
+
+  /** The aggregated view, validated at the trust boundary (DTO → domain). */
+  private view = computed<RemoteData<Err, DashboardView>>(() => {
+    const rd = fromResource(this.viewRes);
+    if (rd.tag !== 'Success') return rd;
+    const parsed = parseDashboardView(rd.value);
+    return parsed.ok
+      ? { tag: 'Success', value: parsed.value }
+      : { tag: 'Failure', error: new Error(parsed.error) };
+  });
+
+  /** Registration + person, from the single aggregated call. */
+  readonly profile = computed<RemoteData<Err, BigProfile>>(() =>
+    map(this.view(), (v) => v.profile),
+  );
+
+  /** Server-computed decisions (e.g. herregistratie eligibility) — rendered, not recomputed. */
+  readonly decisions = computed<RemoteData<Err, HerregistratieDecisions>>(() =>
+    map(this.view(), (v) => v.decisions),
+  );
+
+  /** Specialisms/notes stay a separate stream (they have their own empty state). */
+  readonly aantekeningen = computed<RemoteData<Err, Aantekening[]>>(() => {
+    const rd = fromResource(this.aantekeningenRes, (v) => !v || v.length === 0);
+    return rd.tag === 'Success' ? { tag: 'Success', value: rd.value ?? [] } : rd;
+  });
+
+  // --- Optimistic herregistratie state, shared with the dashboard -----------
+  private pending = signal(false);
+  /** True while a herregistratie submission is in flight or just submitted. */
+  readonly pendingHerregistratie = this.pending.asReadonly();
+
+  beginHerregistratie() {
+    this.pending.set(true); // optimistic: show it immediately on the dashboard
+  }
+  confirmHerregistratie() {
+    this.pending.set(false);
+    this.viewRes.reload(); // invalidate: re-fetch the now-updated view (registration + decisions)
+  }
+  rollbackHerregistratie() {
+    this.pending.set(false); // submission failed — undo the optimistic flag
+  }
+
+  // Retry hooks for [data]-fed <app-async> instances (they don't own the resource).
+  reloadProfile() {
+    this.viewRes.reload();
+  }
+  reloadAantekeningen() {
+    this.aantekeningenRes.reload();
+  }
+}