feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/docs/layers.mdx

@@ -0,0 +1,85 @@
+import { Meta } from '@storybook/addon-docs/blocks';
+
+<Meta title="Foundations/Domain-Driven Design" />
+
+# Domain-driven design: bounded contexts & layers
+
+This project is **domain-driven**: the code is organised first by **bounded context**
+(a business capability with its own language) and then by **layer** inside each context,
+with dependencies pointing inward. The Storybook sidebar is laid out to **be** that
+architecture, not just document it: **Foundations** (this curriculum) → **Design System**
+(reusable, domain-free) → **Domein** (the six DDD contexts). If a component lives under a context's `ui/`, it's in Domein; everything else
+in `shared/ui`/`shared/layout` is Design System. See [Atomic design](?path=/docs/foundations-atomic-design--docs)
+for the Atoms → Molecules → Organisms → Templates ladder inside Design System.
+
+## Six contexts, one direction
+
+```
+src/app/<context>/<layer>/
+```
+
+Contexts: `shared` (the base layer — depends on nothing), `auth`, `registratie`,
+`herregistratie`, `brief` (letter-composition teaching slice), `showcase` (teaching page,
+sanctioned to read every context — nothing imports it).
+
+**Dependencies only point inward and in one declared direction between contexts:**
+
+```
+herregistratie → registratie → shared
+auth           → shared
+brief          → shared
+```
+
+Never the other way — `registratie` may not import `herregistratie`, and no context but
+`shared` is imported by everyone.
+
+## Five layers, one direction
+
+| Layer             | Job                                       | Angular allowed?  |
+| ----------------- | ----------------------------------------- | ----------------- |
+| `domain/`         | business rules + data types               | **No — pure TS.** |
+| `application/`    | coordinate state/tasks (stores, commands) | yes (signals)     |
+| `infrastructure/` | where data comes from (HTTP adapters)     | yes (HTTP)        |
+| `contracts/`      | wire DTOs (the FE⇄BE seam)                | no                |
+| `ui/`             | how it looks (components, pages)          | yes               |
+
+`ui → application → domain`; `ui`/`layout` never import `infrastructure/` directly — they
+reach data through an application store or command.
+
+## This is enforced, not just written down
+
+`eslint.config.mjs` fails the build on every rule above:
+
+- `domain/` importing `@angular/*` at all (any context).
+- `shared/` importing a feature context (`@auth/*`, `@registratie/*`, `@herregistratie/*`,
+  `@brief/*`) — the base layer depends on nothing.
+- `registratie/` importing `@herregistratie/*`/`@brief/*`, `auth/`/`brief/` importing a
+  sibling context — the cross-context direction above.
+- `contracts/**` importing **anything** — not Angular, not an alias, not even a relative
+  path (ADR-0001's wire seam has to stay a pure DTO shape).
+- `ui/**`/`layout/**` importing `*/infrastructure/*` — the anti-corruption boundary
+  (ADR-0001) stays behind a store/command, so a page can never bypass it and hand-recompute
+  a business rule the backend already decided.
+- The generated `ApiClient` imported as a value outside an `infrastructure/` adapter
+  (type-only DTO imports are exempt — they grant no network access).
+
+Two components get a documented exemption from the "nothing reaches across" rule:
+`shared/ui/debug-state` (reads every root store, for the dev-only state panel) and
+`showcase/` (reads every context, for side-by-side teaching pages). Both exemptions live
+next to the rule they break, in `eslint.config.mjs`, so they can't rot silently.
+
+## The English/Dutch seam
+
+Shared/reusable UI is named in **English** (language-agnostic: `button`, `wizard-shell`);
+domain contexts are named in **Dutch** (`registratie`, `herregistratie`, `*.machine.ts`).
+Pick the language by which side of the seam the code is on — it's the same seam this
+sidebar's Design System/Domein split makes visible.
+
+## See it in the sidebar
+
+Compare a Design System primitive with the same shape reused across contexts:
+
+- [Design System → Molecules → Application Link](?path=/story/design-system-molecules-application-link--navigatie) —
+  domain-free, the caller supplies heading/subtitle/cta.
+- [Domein → Registratie → Aanvraag Block](?path=/story/domein-registratie-aanvraag-block--concept) —
+  a context-specific organism composed from Design System atoms/molecules.