feat: implement strangler-fig-demo Session 1 (backend + smoke script)

Builds the four-seam, three-write-path reference demo backend: case-framework
(seam D stand-in), legacy-backend/frontend (SQL Server, seams A/B/C targets),
and new-backend (Domain/Application/Infrastructure.*/Api implementing the
source resolver, take/release-ownership, write-through translator, and owned
assessment flow), wired together via docker-compose with a plain placeholder
frontend standing in for the Angular portal until Session 2.

All 11 Architecture.Tests pass and scripts/smoke.sh passes end-to-end against
a fresh `docker compose up`, covering acceptance criteria 1-3 and 7-22.

Fixes two real domain bugs found only once the stack ran for real: the BSN
eleven-proof checksum trivially passes all-zero digits, and the adoption
mapper silently treated a partial legacy address as absent instead of failing
loudly. Also fixes several environment-specific integration issues (rootless
Podman/SELinux bind-mount permissions, a buildah NuGet layer-caching bug,
SqlClient's invariant-globalization incompatibility, and an nginx path-prefix
mismatch for the legacy frontend).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

new/src/New.Api/Resolution/ApplicationSourceResolver.cs

@@ -0,0 +1,33 @@
+using New.Application.Ports;
+using New.Application.Worklist;
+using New.Infrastructure.Legacy;
+using New.Infrastructure.Persistence;
+
+namespace New.Api.Resolution;
+
+/// <summary>
+/// The ONLY type in the whole solution that references both
+/// <see cref="OwnedApplicationSource"/> and <see cref="LegacyCaseSource"/> -
+/// Architecture.Tests rule 7 asserts exactly that. Every other type that
+/// needs case data reaches it through a port (IApplicationSource for
+/// by-id resolution, or IOwnedWorklistReader/ILegacyWorklistReader for the
+/// merged worklist listing - deliberately different types, see those
+/// interfaces' remarks) without ever knowing there are two sources at all.
+/// This is the seam-hiding point of the whole "strangler fig" design: a
+/// legacy aanvraagId keeps working transparently after adoption, because
+/// this resolver - and only this resolver - knows to check the ownership
+/// registry first and redirect to the owned copy when present.
+/// </summary>
+internal sealed class ApplicationSourceResolver(
+    OwnedApplicationSource owned,
+    LegacyCaseSource legacy,
+    IOwnershipRegistry registry) : IApplicationSource
+{
+    public async Task<CaseDetail?> GetByLegacyIdAsync(int aanvraagId, CancellationToken ct)
+    {
+        var ownedId = await registry.LookupOwnedIdAsync(aanvraagId, ct);
+        return ownedId is null
+            ? await legacy.GetAsync(aanvraagId, ct)      // seam A
+            : await owned.GetAsync(ownedId.Value, ct);    // owned
+    }
+}