test(backend): split RuleTests.cs by aggregate, refresh DDD doc (WP-71)

RuleTests.cs held five aggregates' rules as nested classes in one file,
misaligned with Domain/<Aggregate>/ and with the Acceptance/Builders/
folder convention WP-70 started. Split into Domain/<Aggregate>RuleTests.cs
(pure move — same names, same bodies, same count) plus a new
ApplicationRuleTests.cs (the enum invariant moved out of the
WebApplicationFactory-booting ApplicationTests.cs, since it's a pure
Enum.GetNames check with no business needing a web host) and
OrgTemplateRuleTests.cs (RejectDraft had no direct unit test before,
only endpoint coverage).

libs/shared/docs/layers.mdx still taught the pre-WP-67 shape (six
contexts, no apps/libs split, enforcement via ESLint) — updated to the
real monorepo structure and to dependency-cruiser as the actual
enforcement mechanism. Adds specs for registration.policy.ts's
isStatusConsistent (untested; its backend mirror is) and both apps'
auth/domain/session.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/Domain/DocumentRuleTests.cs

@@ -0,0 +1,58 @@
+using BigRegister.Domain.Documents;
+
+namespace BigRegister.Tests.Domain;
+
+public class DocumentRuleTests
+{
+  [Fact]
+  public void Rejects_unknown_category() =>
+      Assert.NotNull(DocumentRules.RejectUpload(null, "application/pdf", 1));
+
+  [Fact]
+  public void Rejects_disallowed_type()
+  {
+    var c = DocumentRules.Find("registratie", "diploma");
+    Assert.NotNull(DocumentRules.RejectUpload(c, "text/plain", 1));
+  }
+
+  [Fact]
+  public void Rejects_oversized_file()
+  {
+    var c = DocumentRules.Find("registratie", "diploma");
+    Assert.NotNull(DocumentRules.RejectUpload(c, "application/pdf", 11L * 1024 * 1024));
+  }
+
+  [Fact]
+  public void Accepts_valid_file()
+  {
+    var c = DocumentRules.Find("registratie", "diploma");
+    Assert.Null(DocumentRules.RejectUpload(c, "application/pdf", 5L * 1024 * 1024));
+  }
+
+  private static IReadOnlyList<string> Ids(string? herkomst, string? taalvaardigheid) =>
+      DocumentRules.CategoriesFor("registratie", herkomst, taalvaardigheid).Select(c => c.CategoryId).ToList();
+
+  [Fact]
+  public void First_load_has_no_diploma_upload() => // no diploma chosen yet
+      Assert.Equal(new[] { "identiteit" }, Ids(null, null));
+
+  [Fact]
+  public void Manual_diploma_needs_a_diploma_upload() =>
+      Assert.Equal(new[] { "diploma", "identiteit" }, Ids("handmatig", null));
+
+  [Fact]
+  public void Duo_diploma_skips_diploma_upload() =>
+      Assert.DoesNotContain("diploma", Ids("duo", null));
+
+  [Fact]
+  public void Confirmed_dutch_proficiency_requires_taalvaardigheid_proof() =>
+      Assert.Contains("taalvaardigheid", Ids("handmatig", "ja"));
+
+  [Fact]
+  public void Unconfirmed_proficiency_requires_no_taalvaardigheid_proof() =>
+      Assert.DoesNotContain("taalvaardigheid", Ids("handmatig", "nee"));
+
+  [Fact]
+  public void Find_resolves_taalvaardigheid_for_upload_validation() =>
+      Assert.NotNull(DocumentRules.Find("registratie", "taalvaardigheid"));
+}