test(backend): split RuleTests.cs by aggregate, refresh DDD doc (WP-71)

RuleTests.cs held five aggregates' rules as nested classes in one file,
misaligned with Domain/<Aggregate>/ and with the Acceptance/Builders/
folder convention WP-70 started. Split into Domain/<Aggregate>RuleTests.cs
(pure move — same names, same bodies, same count) plus a new
ApplicationRuleTests.cs (the enum invariant moved out of the
WebApplicationFactory-booting ApplicationTests.cs, since it's a pure
Enum.GetNames check with no business needing a web host) and
OrgTemplateRuleTests.cs (RejectDraft had no direct unit test before,
only endpoint coverage).

libs/shared/docs/layers.mdx still taught the pre-WP-67 shape (six
contexts, no apps/libs split, enforcement via ESLint) — updated to the
real monorepo structure and to dependency-cruiser as the actual
enforcement mechanism. Adds specs for registration.policy.ts's
isStatusConsistent (untested; its backend mirror is) and both apps'
auth/domain/session.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/auth/domain/session.spec.ts

@@ -0,0 +1,14 @@
+import { describe, it, expect } from 'vitest';
+import { isAuthenticated, Session } from './session';
+
+const session: Session = { bsn: '19012345601', naam: 'Test' };
+
+describe('isAuthenticated', () => {
+  it('narrows a present session to Session', () => {
+    expect(isAuthenticated(session)).toBe(true);
+  });
+
+  it('reports no session as not authenticated', () => {
+    expect(isAuthenticated(null)).toBe(false);
+  });
+});

apps/ssp/src/app/herregistratie/ui/intake-wizard/intake-wizard.component.spec.ts

@@ -10,6 +10,14 @@ import { IntakeState } from '@herregistratie/domain/intake.machine';
 // wrapping is dropped, the inputs revert to bare white. The buitenland step with
 // buitenlandGewerkt='ja' has two groups (the question + the land/uren follow-up), so it
 // must render ≥2 fieldsets, each holding a form-group.
+//
+// SANCTIONED TestBed exception (CLAUDE.md "Testing": UI is normally exercised via Storybook,
+// not heavy component tests): this pins the *count and nesting* of rendered DOM nodes for a
+// specific machine state (2+ <fieldset> wrappers, each containing a .form-group), which is a
+// structural/visual regression, not an accessibility one — a Storybook a11y (axe) run checks
+// for accessibility violations on whatever markup is rendered, it does not assert that the
+// markup takes this particular shape, so it would not catch the grouping silently collapsing
+// back to bare inputs.
 const buitenlandJa: IntakeState = {
   tag: 'Answering',
   answers: { buitenlandGewerkt: 'ja' },

apps/ssp/src/app/registratie/domain/registration.policy.spec.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
-import { Registration } from './registration';
-import { isHerregistratieEligible, statusColor } from './registration.policy';
+import { Registration, RegistrationStatus } from './registration';
+import { isHerregistratieEligible, isStatusConsistent, statusColor } from './registration.policy';
 
 const reg = (status: Registration['status']): Registration => ({
   bigNummer: '19012345601',
@@ -38,4 +38,26 @@ describe('registration.policy', () => {
     expect(statusColor('Doorgehaald')).toContain('rood');
     expect(statusColor('Geschorst')).toContain('oranje');
   });
+
+  it('a well-formed status is always consistent', () => {
+    expect(
+      isStatusConsistent(reg({ tag: 'Geregistreerd', herregistratieDatum: '2027-01-01' }).status),
+    ).toBe(true);
+    expect(
+      isStatusConsistent(
+        reg({ tag: 'Doorgehaald', doorgehaaldOp: '2024-05-01', reden: 'x' }).status,
+      ),
+    ).toBe(true);
+    expect(
+      isStatusConsistent(reg({ tag: 'Geschorst', geschorstTot: '2026-12-31', reden: 'x' }).status),
+    ).toBe(true);
+  });
+
+  it('a Geregistreerd status without its herregistratieDatum is inconsistent', () => {
+    // The union itself makes this unrepresentable through normal construction (every
+    // Geregistreerd literal must carry a herregistratieDatum) — only reachable here by
+    // bypassing the type system, the way malformed runtime/serialized data could.
+    const malformed = { tag: 'Geregistreerd' } as unknown as RegistrationStatus;
+    expect(isStatusConsistent(malformed)).toBe(false);
+  });
 });