test(backend): split RuleTests.cs by aggregate, refresh DDD doc (WP-71)

RuleTests.cs held five aggregates' rules as nested classes in one file,
misaligned with Domain/<Aggregate>/ and with the Acceptance/Builders/
folder convention WP-70 started. Split into Domain/<Aggregate>RuleTests.cs
(pure move — same names, same bodies, same count) plus a new
ApplicationRuleTests.cs (the enum invariant moved out of the
WebApplicationFactory-booting ApplicationTests.cs, since it's a pure
Enum.GetNames check with no business needing a web host) and
OrgTemplateRuleTests.cs (RejectDraft had no direct unit test before,
only endpoint coverage).

libs/shared/docs/layers.mdx still taught the pre-WP-67 shape (six
contexts, no apps/libs split, enforcement via ESLint) — updated to the
real monorepo structure and to dependency-cruiser as the actual
enforcement mechanism. Adds specs for registration.policy.ts's
isStatusConsistent (untested; its backend mirror is) and both apps'
auth/domain/session.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/auth/domain/session.spec.ts

@@ -0,0 +1,14 @@
+import { describe, it, expect } from 'vitest';
+import { isAuthenticated, Session } from './session';
+
+const session: Session = { bsn: '19012345601', naam: 'Test' };
+
+describe('isAuthenticated', () => {
+  it('narrows a present session to Session', () => {
+    expect(isAuthenticated(session)).toBe(true);
+  });
+
+  it('reports no session as not authenticated', () => {
+    expect(isAuthenticated(null)).toBe(false);
+  });
+});