feat(portal-self-service): implement the DigiD registration submit page (refs #67)

RegistrationPage shows the signed-in BSN and submits to the BFF via the generated
api-client, confirming with the returned reference; built from NL Design System
(Utrecht) components. Wire the guarded route + app providers (DigiD OIDC + token
interceptor + HttpClient), the NL DS theme, and lang=nl. Component tests
(Testing Library) + axe (WCAG 2.1 AA) pass; a guard test covers libs/auth. Replace
the demo eslint depConstraints (scope:shop/shared) with a permissive default.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/self-service/src/app/app.config.ts

@@ -1,10 +1,22 @@
+import { provideHttpClient, withInterceptors } from '@angular/common/http';
 import {
   ApplicationConfig,
   provideBrowserGlobalErrorListeners,
 } from '@angular/core';
 import { provideRouter } from '@angular/router';
+import { authInterceptor, provideDigiadAuth } from 'auth';
 import { appRoutes } from './app.routes';
 
 export const appConfig: ApplicationConfig = {
-  providers: [provideBrowserGlobalErrorListeners(), provideRouter(appRoutes)],
+  providers: [
+    provideBrowserGlobalErrorListeners(),
+    provideRouter(appRoutes),
+    provideHttpClient(withInterceptors([authInterceptor()])),
+    // Dev defaults (host ports). The compose-served app overrides these for the stack (S-08d).
+    provideDigiadAuth({
+      authority: 'http://localhost:8180/realms/digid',
+      redirectUrl: typeof window !== 'undefined' ? window.location.origin : '/',
+      secureApiOrigin: 'http://localhost:8080',
+    }),
+  ],
 };