feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/registratie/domain/registration.policy.ts

@@ -0,0 +1,58 @@
+import { assertNever } from '@shared/kernel/fp';
+import { Registration, RegistrationStatus, StatusTag } from './registration';
+
+/**
+ * Domain logic for a registration — pure functions, NO Angular. This is where
+ * "what the business rules say" lives, separate from "how it looks" (UI) and
+ * "where the data comes from" (infrastructure). Keeping it framework-free means
+ * it is trivial to read and unit-test.
+ */
+
+/** Human-readable label for a status. */
+export function statusLabel(tag: StatusTag): string {
+  return tag; // the tag already reads as Dutch; kept as a function so labels can diverge later
+}
+
+/** Brand colour token for a status. assertNever forces a colour for every new
+    status variant at compile time. */
+export function statusColor(tag: StatusTag): string {
+  switch (tag) {
+    case 'Geregistreerd':
+      return 'var(--rhc-color-groen-500)';
+    case 'Doorgehaald':
+      return 'var(--rhc-color-rood-500)';
+    case 'Geschorst':
+      return 'var(--rhc-color-oranje-500)';
+    default:
+      return assertNever(tag);
+  }
+}
+
+/** The herregistratie deadline, if the status has one (only the active state does). */
+export function herregistratieDeadline(reg: Registration): Date | null {
+  return reg.status.tag === 'Geregistreerd' ? new Date(reg.status.herregistratieDatum) : null;
+}
+
+/** A registration may apply for herregistratie only while active and within the
+    window before its deadline. A struck-off or suspended registration may not.
+    SERVER-OWNED RULE: this now runs on the backend (BFF), which ships the result
+    as `decisions.eligibleForHerregistratie` in the dashboard view. Kept here as
+    the reference implementation + unit test; the frontend no longer calls it. */
+export function isHerregistratieEligible(
+  reg: Registration,
+  today: Date,
+  windowMonths = 12,
+): boolean {
+  const deadline = herregistratieDeadline(reg);
+  if (!deadline) return false;
+  const windowStart = new Date(deadline);
+  windowStart.setMonth(windowStart.getMonth() - windowMonths);
+  return today >= windowStart;
+}
+
+/** Invariant check used in tests/demos: a non-active status must not carry a
+    herregistratie date. The union already enforces this structurally; this is
+    the runtime statement of the same rule. */
+export function isStatusConsistent(status: RegistrationStatus): boolean {
+  return status.tag === 'Geregistreerd' ? typeof status.herregistratieDatum === 'string' : true;
+}