feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/ui/alert/alert.component.ts

@@ -0,0 +1,50 @@
+import { Component, input } from '@angular/core';
+
+type AlertType = 'info' | 'ok' | 'warning' | 'error';
+
+// visually-hidden alternative for the status icon (CIBG a11y requirement).
+const ICON_LABELS: Record<AlertType, string> = {
+  info: $localize`:@@alert.icon.info:Informatie`,
+  ok: $localize`:@@alert.icon.ok:Gelukt`,
+  warning: $localize`:@@alert.icon.warning:Waarschuwing`,
+  error: $localize`:@@alert.icon.error:Foutmelding`,
+};
+
+/** Atom: alert/message banner — the CIBG Huisstijl "melding"
+    (designsystem.cibg.nl/componenten/meldingen). Thin wrapper over the vendored
+    `.feedback feedback-*` classes: the design system owns surface + icon; we add
+    only the icon's a11y label and a content wrapper (`.feedback` is a flex row).
+    Errors are `role="alert"` (assertive — interrupts) since they need immediate
+    attention; other variants stay `role="status"` (polite) so success/info banners
+    don't interrupt what the user is doing. */
+@Component({
+  selector: 'app-alert',
+  styles: [
+    `
+      .feedback > div {
+        flex: 1 1 auto;
+        min-width: 0;
+      }
+    `,
+  ],
+  template: `
+    <div
+      class="feedback"
+      [class.feedback-info]="type() === 'info'"
+      [class.feedback-success]="type() === 'ok'"
+      [class.feedback-warning]="type() === 'warning'"
+      [class.feedback-error]="type() === 'error'"
+      [attr.role]="type() === 'error' ? 'alert' : 'status'"
+      aria-atomic="true"
+    >
+      <span class="icon"
+        ><span class="visually-hidden">{{ iconLabels[type()] }}</span></span
+      >
+      <div><ng-content /></div>
+    </div>
+  `,
+})
+export class AlertComponent {
+  type = input<AlertType>('info');
+  protected readonly iconLabels = ICON_LABELS;
+}

libs/shared/src/ui/alert/alert.stories.ts

@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from '@storybook/angular';
+import { expect, within } from 'storybook/test';
+import { AlertComponent } from './alert.component';
+
+const meta: Meta<AlertComponent> = {
+  title: 'Design System/Atoms/Alert',
+  component: AlertComponent,
+  render: (args) => ({
+    props: args,
+    template: `<app-alert [type]="type">Uw wijziging is ontvangen.</app-alert>`,
+  }),
+};
+export default meta;
+type Story = StoryObj<AlertComponent>;
+
+// role assertions guard the polite/assertive split (WP-16): errors interrupt, others don't.
+export const Info: Story = {
+  args: { type: 'info' },
+  play: async ({ canvasElement }) => {
+    await expect(within(canvasElement).getByRole('status')).toBeInTheDocument();
+  },
+};
+export const Ok: Story = {
+  args: { type: 'ok' },
+  play: async ({ canvasElement }) => {
+    await expect(within(canvasElement).getByRole('status')).toBeInTheDocument();
+  },
+};
+export const Warning: Story = {
+  args: { type: 'warning' },
+  play: async ({ canvasElement }) => {
+    await expect(within(canvasElement).getByRole('status')).toBeInTheDocument();
+  },
+};
+export const Error: Story = {
+  args: { type: 'error' },
+  play: async ({ canvasElement }) => {
+    await expect(within(canvasElement).getByRole('alert')).toBeInTheDocument();
+  },
+};