feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/application/store.ts

@@ -0,0 +1,33 @@
+import { Signal, signal } from '@angular/core';
+
+/**
+ * A tiny "Elm-style" store. The whole idea: all state lives in ONE value
+ * (the Model). The only way to change it is to send a message (Msg) to a PURE
+ * function `update(model, msg)` that returns the next Model. Nothing else
+ * mutates state, so to understand the app you only read the update function.
+ *
+ * Side effects (HTTP, timers) do NOT go in `update` — that stays pure and easy
+ * to test. Instead, effectful "command" functions call the network and then
+ * `dispatch` a message describing what happened (e.g. Loaded / Failed).
+ */
+export interface Store<Model, Msg> {
+  /** The current state, as a read-only Angular signal. */
+  readonly model: Signal<Model>;
+  /** Send a message; the model becomes update(model, msg). */
+  dispatch(msg: Msg): void;
+}
+
+export function createStore<Model, Msg>(
+  init: Model,
+  update: (model: Model, msg: Msg) => Model,
+): Store<Model, Msg> {
+  const model = signal(init);
+  return {
+    model: model.asReadonly(),
+    // Use `.update` (raw current value, no tracked read) not `set(update(model(), …))`:
+    // dispatch is a command and must never subscribe its caller to `model`. Reading
+    // `model()` here inside an effect that also dispatches makes the effect depend on
+    // its own write and livelock the main thread (crashed the upload wizards).
+    dispatch: (msg) => model.update((m) => update(m, msg)),
+  };
+}