test(backend): split RuleTests.cs by aggregate, refresh DDD doc (WP-71)

RuleTests.cs held five aggregates' rules as nested classes in one file,
misaligned with Domain/<Aggregate>/ and with the Acceptance/Builders/
folder convention WP-70 started. Split into Domain/<Aggregate>RuleTests.cs
(pure move — same names, same bodies, same count) plus a new
ApplicationRuleTests.cs (the enum invariant moved out of the
WebApplicationFactory-booting ApplicationTests.cs, since it's a pure
Enum.GetNames check with no business needing a web host) and
OrgTemplateRuleTests.cs (RejectDraft had no direct unit test before,
only endpoint coverage).

libs/shared/docs/layers.mdx still taught the pre-WP-67 shape (six
contexts, no apps/libs split, enforcement via ESLint) — updated to the
real monorepo structure and to dependency-cruiser as the actual
enforcement mechanism. Adds specs for registration.policy.ts's
isStatusConsistent (untested; its backend mirror is) and both apps'
auth/domain/session.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/Domain/ApplicationRuleTests.cs

@@ -0,0 +1,17 @@
+using BigRegister.Domain.Applications;
+
+namespace BigRegister.Tests.Domain;
+
+public class ApplicationRuleTests
+{
+  // WP-63: the published lifecycle (ADR-0002) must name exactly these five tags, in this
+  // order — ToStatusDto's string literals must keep matching Enum.ToString(), and Ingediend/
+  // MeerInfoGevraagd (unreachable until WP-65 adds the behandelaar transition) stay defined.
+  [Fact]
+  public void AanvraagStatusTag_covers_the_published_lifecycle()
+  {
+    Assert.Equal(
+        new[] { "Ingediend", "InBehandeling", "MeerInfoGevraagd", "Goedgekeurd", "Afgewezen" },
+        Enum.GetNames<AanvraagStatusTag>());
+  }
+}