feat(boundaries): WP-04 — ui ↛ infrastructure + showcase sanction

Move the two wizard lookups behind application-layer facades so ui/ no longer
injects infrastructure adapters directly:
- RegistratieLookupStore (BRP address + DUO diplomas): owns the resources,
  runs the trust-boundary parse, exposes adresStatus/prefillAdres/duoLookup.
- IntakePolicyStore (scholing threshold): owns the policy resource, exposes
  the derived threshold.

Add the lint rule ui/ + layout/ ↛ **/infrastructure/** (@typescript-eslint
variant so it composes with the base direction rules; stories/specs exempted
as test scaffolding). Add the documented showcase sanction (may read every
context). Fix the docs' inventory: 6 contexts / 5 layers, +brief, +contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

eslint.config.mjs

@@ -143,4 +143,44 @@ export default [
     plugins: { '@typescript-eslint': tseslint.plugin },
     rules: { '@typescript-eslint/no-restricted-imports': 'off' },
   },
+
+  // ui/ and layout/ are the presentation layer: dependencies point inward
+  // (ui → application → domain, CLAUDE.md §1), so they must NOT import
+  // infrastructure/ directly — they reach data through an application store or
+  // command. (Stories/specs are test scaffolding and may wire the real client.)
+  // Uses the @typescript-eslint variant so it composes with the base
+  // no-restricted-imports context-direction rules above (last-wins is per rule name).
+  {
+    files: ['src/app/**/ui/**/*.ts', 'src/app/**/layout/**/*.ts'],
+    ignores: ['**/*.stories.ts', '**/*.spec.ts'],
+    plugins: { '@typescript-eslint': tseslint.plugin },
+    rules: {
+      '@typescript-eslint/no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: [
+                '@shared/infrastructure/*',
+                '@auth/infrastructure/*',
+                '@registratie/infrastructure/*',
+                '@herregistratie/infrastructure/*',
+                '@brief/infrastructure/*',
+              ],
+              allowTypeImports: true,
+              message: 'ui/ and layout/ must not import infrastructure/ directly (CLAUDE.md §1: ui → application → domain). Reach data through an application store or command. (Type-only DTO imports are fine: use `import type`.)',
+            },
+          ],
+        },
+      ],
+    },
+  },
+
+  // Sanctioned exception: showcase/ is the teaching page whose whole point is showing
+  // multiple contexts side by side (ARCHITECTURE.md §6). It may read every context;
+  // nothing imports showcase. Same precedent as the shared/ui/debug-state exemption.
+  {
+    files: ['src/app/showcase/**/*.ts'],
+    rules: { 'no-restricted-imports': 'off' },
+  },
 ];