feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/ui/upload/document-chip/document-chip.component.ts

@@ -0,0 +1,68 @@
+import { Component, computed, input } from '@angular/core';
+import type { UploadStatus } from '@shared/upload/upload.machine';
+import { UploadStatusIconComponent } from '../upload-status-icon/upload-status-icon.component';
+
+const STATUS_LABELS: Record<UploadStatus['type'], string> = {
+  idle: '',
+  queued: $localize`:@@upload.status.queued:In wachtrij`,
+  uploading: $localize`:@@upload.status.uploading:Bezig met uploaden`,
+  complete: $localize`:@@upload.status.complete:Geüpload`,
+  failed: $localize`:@@upload.status.failed:Mislukt`,
+  deleting: $localize`:@@upload.status.deleting:Bezig met verwijderen`,
+  deleted: '',
+};
+
+/** Atom: the `.file` block of a CIBG Bestand-upload file row — a status glyph, the
+    filename (a download link once complete) and a `.file-meta` line (size + status).
+    `display:contents` so `.file` becomes a flex child of the `.file-container` row.
+    Pure UI. */
+@Component({
+  selector: 'app-document-chip',
+  imports: [UploadStatusIconComponent],
+  styles: [
+    `
+      :host {
+        display: contents;
+      }
+      .file {
+        display: flex;
+        flex-direction: column;
+        gap: var(--rhc-space-max-xs);
+        min-inline-size: 0;
+      }
+      .file-name {
+        word-break: break-all;
+      }
+    `,
+  ],
+  template: `
+    <div class="file">
+      <span class="d-inline-flex align-items-center gap-2">
+        <app-upload-status-icon [status]="status().type" />
+        @if (previewUrl()) {
+          <a class="file-name" [href]="previewUrl()" target="_blank" rel="noopener">{{
+            fileName()
+          }}</a>
+        } @else {
+          <span class="file-name">{{ fileName() }}</span>
+        }
+      </span>
+      <span class="file-meta">{{ meta() }}</span>
+    </div>
+  `,
+})
+export class DocumentChipComponent {
+  fileName = input.required<string>();
+  status = input.required<UploadStatus>();
+  fileSizeMb = input(0);
+  /** When set, the filename is a preview/download link (opens the stored bytes). */
+  previewUrl = input<string>();
+
+  /** `.file-meta`: file size + status word (+ the failure reason when failed). */
+  protected meta = computed(() => {
+    const s = this.status();
+    const size = this.fileSizeMb() > 0 ? `${this.fileSizeMb().toFixed(1)} MB` : '';
+    const label = s.type === 'failed' && s.reason ? s.reason : STATUS_LABELS[s.type];
+    return [size, label].filter(Boolean).join(' · ');
+  });
+}