test(backend): split RuleTests.cs by aggregate, refresh DDD doc (WP-71)

RuleTests.cs held five aggregates' rules as nested classes in one file,
misaligned with Domain/<Aggregate>/ and with the Acceptance/Builders/
folder convention WP-70 started. Split into Domain/<Aggregate>RuleTests.cs
(pure move — same names, same bodies, same count) plus a new
ApplicationRuleTests.cs (the enum invariant moved out of the
WebApplicationFactory-booting ApplicationTests.cs, since it's a pure
Enum.GetNames check with no business needing a web host) and
OrgTemplateRuleTests.cs (RejectDraft had no direct unit test before,
only endpoint coverage).

libs/shared/docs/layers.mdx still taught the pre-WP-67 shape (six
contexts, no apps/libs split, enforcement via ESLint) — updated to the
real monorepo structure and to dependency-cruiser as the actual
enforcement mechanism. Adds specs for registration.policy.ts's
isStatusConsistent (untested; its backend mirror is) and both apps'
auth/domain/session.ts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/Domain/SubmissionRuleTests.cs

@@ -0,0 +1,30 @@
+using BigRegister.Domain.Submissions;
+
+namespace BigRegister.Tests.Domain;
+
+public class SubmissionRuleTests
+{
+  [Fact]
+  public void Manual_diploma_is_rejected() =>
+      Assert.NotNull(SubmissionRules.RejectRegistratie("handmatig"));
+
+  [Fact]
+  public void Duo_diploma_is_accepted() =>
+      Assert.Null(SubmissionRules.RejectRegistratie("duo"));
+
+  [Fact]
+  public void Zero_hours_is_rejected() =>
+      Assert.NotNull(SubmissionRules.RejectZeroUren(0));
+
+  [Fact]
+  public void Worked_hours_are_accepted() =>
+      Assert.Null(SubmissionRules.RejectZeroUren(40));
+
+  [Theory]
+  [InlineData("0612345678", null)]              // valid mobile
+  [InlineData("070 123 45 67", null)]           // valid landline, formatting stripped
+  [InlineData("nope", "Voer een geldig telefoonnummer in, bijv. 0612345678.")]
+  [InlineData("12345", "Voer een geldig telefoonnummer in, bijv. 0612345678.")]
+  public void Phone_change_is_validated(string telefoon, string? expected) =>
+      Assert.Equal(expected, SubmissionRules.RejectPhoneChange(telefoon));
+}