feat(stamdata): admin stamdata maintenance editor (beheer)

Realizes ADR-0004's "future low-code editor that commits a PR": an
admin-only stamdata maintenance editor built on the stamdata-as-code
foundation.

Backend: `professions` moves from a hardcoded C# dictionary to an embedded
`professions.json` data-file (typed as `ProfessionMapping`) with valid-time
(geldigVan/geldigTot, half-open). A generic, reflection-driven
StamdataCatalog/StamdataTable/StamdataFile describes every table so one
endpoint pair + one grid editor serve all of them; add a table in one line.
Two read-only, admin-gated endpoints (GET /stamdata, GET /stamdata/{table}
?peildatum=) — no runtime write path. Generic build gate
`Every_catalog_table_is_valid` (keys non-blank, no overlapping validity,
well-formed windows).

Frontend: new `beheer` context (route beheer/stamdata, capabilityGuard
'stamdata:edit'). A schema-driven grid editor edits rows locally; download()
emits {table}.json for the admin to commit as a reviewed PR (no mutation
command — the CI build + StamdataValidationTests stay the authority).

Full gate GREEN both sides; gen:api leaves no drift; new stamdata story
passes axe. See WP-29 + ADR-0004.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

eslint.config.mjs

@@ -76,7 +76,7 @@ export default [
         {
           patterns: [
             {
-              group: ['@auth/*', '@registratie/*', '@herregistratie/*', '@brief/*'],
+              group: ['@auth/*', '@registratie/*', '@herregistratie/*', '@brief/*', '@beheer/*'],
               message: 'shared/ must not depend on a feature context.',
             },
           ],
@@ -94,7 +94,7 @@ export default [
         {
           patterns: [
             {
-              group: ['@registratie/*', '@herregistratie/*', '@brief/*'],
+              group: ['@registratie/*', '@herregistratie/*', '@brief/*', '@beheer/*'],
               message: 'auth/ may depend only on shared.',
             },
           ],
@@ -112,7 +112,7 @@ export default [
         {
           patterns: [
             {
-              group: ['@herregistratie/*', '@brief/*'],
+              group: ['@herregistratie/*', '@brief/*', '@beheer/*'],
               message: 'Dependencies point herregistratie → registratie → shared, never back.',
             },
           ],
@@ -130,7 +130,7 @@ export default [
         {
           patterns: [
             {
-              group: ['@auth/*', '@registratie/*', '@herregistratie/*'],
+              group: ['@auth/*', '@registratie/*', '@herregistratie/*', '@beheer/*'],
               message: 'brief/ may depend only on shared.',
             },
           ],
@@ -139,6 +139,24 @@ export default [
     },
   },
 
+  // beheer/ (stamdata maintenance) is an independent leaf context: it may depend only on shared.
+  {
+    files: ['src/app/beheer/**/*.ts'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['@auth/*', '@registratie/*', '@herregistratie/*', '@brief/*'],
+              message: 'beheer/ may depend only on shared.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+
   // contracts/ is the FE⇄BE wire seam: pure DTO shapes that must import NOTHING
   // (CLAUDE.md §1, ADR-0001) — not Angular, not a context alias, not relative app
   // code. Enums are inlined string-literal unions; the adapter's parse* maps them.
@@ -158,6 +176,7 @@ export default [
                 '@registratie/**',
                 '@herregistratie/**',
                 '@brief/**',
+                '@beheer/**',
                 './*',
                 '../*',
                 './**',
@@ -225,6 +244,7 @@ export default [
                 '@registratie/infrastructure/*',
                 '@herregistratie/infrastructure/*',
                 '@brief/infrastructure/*',
+                '@beheer/infrastructure/*',
               ],
               allowTypeImports: true,
               message: