fix(portal-self-service): run checkAuth() at startup to end the login redirect loop (refs #67)

Without an app-init auth check, the DigiD callback (?code=…) was never processed, so
the guard kept seeing 'not authenticated' and re-triggered login — an infinite
redirect loop. Add withAppInitializerAuthCheck() so checkAuth() runs before the router
and guard, establishing the session on the callback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

libs/auth/src/lib/digid-auth.providers.ts

@@ -1,5 +1,10 @@
 import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
-import { authInterceptor, LogLevel, provideAuth } from 'angular-auth-oidc-client';
+import {
+  authInterceptor,
+  LogLevel,
+  provideAuth,
+  withAppInitializerAuthCheck,
+} from 'angular-auth-oidc-client';
 import { AuthService } from './auth.service';
 import { DigiadAuthService } from './digid-auth.service';
 
@@ -19,7 +24,8 @@ export interface DigiadAuthOptions {
  */
 export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProviders {
   return makeEnvironmentProviders([
-    provideAuth({
+    provideAuth(
+      {
         config: {
           authority: options.authority,
           redirectUrl: options.redirectUrl,
@@ -32,7 +38,11 @@ export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProvid
           secureRoutes: [options.secureApiOrigin],
           logLevel: LogLevel.Warn,
         },
-    }),
+      },
+      // Run checkAuth() at startup so the DigiD callback (?code=…) is processed before the router
+      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
+      withAppInitializerAuthCheck(),
+    ),
     { provide: AuthService, useClass: DigiadAuthService },
   ]);
 }

libs/ui/src/index.ts

@@ -5,13 +5,7 @@
 // The Utrecht v3 components are NgModule-based (not standalone), so we re-export the module.
 // A standalone component consumes them by importing UtrechtComponentsModule in its `imports`
 // (CLAUDE.md §10 forbids *declaring* NgModules in our code, not consuming a third-party one).
-// The component classes are re-exported too so the AOT compiler can resolve the template
+// Re-export the whole Utrecht package: importing UtrechtComponentsModule pulls every component it
-// directives (utrecht-article, utrecht-button, …) through this barrel.
+// exports into the compiler's scope, so the AOT build needs all of them resolvable through this
-export {
+// barrel (a partial re-export fails with NG3004 for the first unused component).
-  UtrechtArticle,
+export * from '@utrecht/component-library-angular';
-  UtrechtButtonAttr,
-  UtrechtComponentsModule,
-  UtrechtDocument,
-  UtrechtHeading1,
-  UtrechtParagraph,
-} from '@utrecht/component-library-angular';