feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/showcase/highlight-ts.ts

@@ -0,0 +1,49 @@
+/**
+ * Tiny, dependency-free TS highlighter for the teaching showcase (WP-39). Escapes HTML,
+ * then wraps line-comments, strings, and a fixed keyword set in `.c`/`.s`/`.k` spans (the
+ * classes `concepts.page` styles). Deliberately naive — good enough for the short, curated
+ * snippets shown here; not a real tokenizer. Input is always our OWN source (extracted by
+ * `scripts/gen-snippets.mjs` or authored inline), so the `[innerHTML]` sink is safe once
+ * the HTML metacharacters are escaped first. Pure.
+ */
+const KEYWORDS = [
+  'interface',
+  'type',
+  'export',
+  'import',
+  'from',
+  'const',
+  'let',
+  'return',
+  'function',
+  'switch',
+  'case',
+  'default',
+  'if',
+  'else',
+  'new',
+  'readonly',
+  'extends',
+  'as',
+  'void',
+];
+
+const escapeHtml = (s: string): string =>
+  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+
+export function highlightTs(code: string): string {
+  const kw = new RegExp(`\\b(${KEYWORDS.join('|')})\\b`, 'g');
+  return escapeHtml(code)
+    .split('\n')
+    .map((line) => {
+      // Line comment: everything from // to EOL is one comment span (skip the rest).
+      const c = line.indexOf('//');
+      const head = c === -1 ? line : line.slice(0, c);
+      const tail = c === -1 ? '' : `<span class="c">${line.slice(c)}</span>`;
+      const lit = head
+        .replace(/(['"`])(?:\\.|(?!\1).)*\1/g, (m) => `<span class="s">${m}</span>`) // strings
+        .replace(kw, '<span class="k">$1</span>'); // keywords
+      return lit + tail;
+    })
+    .join('\n');
+}