The behandel-portal authenticates staff against the Keycloak `medewerker` realm. Add
MedewerkerAuthService (reads nested realm_access.roles), provideMedewerkerAuth, a roles/hasRole
surface on the shared AuthService, and a realm-roles protocol mapper so the frontend can read
the behandelaar/teamlead roles from the token. Per ADR-0013 the BFF remains the security boundary.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Scaffold libs/ui (NL Design System via Utrecht components) and libs/auth (DigiD OIDC
over angular-auth-oidc-client: mockable AuthService, provider, token interceptor,
authenticated guard). Failing component + axe tests for the RegistrationPage: it must
show the signed-in BSN, submit to the BFF (mocked api-client) and confirm, with no
WCAG 2.1 AA violations. The page is a stub, so the behaviour tests fail; green follows.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
