fix(flags): surface a failed admin toggle instead of swallowing it

FeatureFlagStore.set() was try/finally with no catch. A rejected
PUT /admin/flags/{key} escaped into the `void this.store.set(...)` call site
as an unhandled promise rejection; the finally-block reload then snapped the
control back to its old value. The admin saw a toggle that silently refused
to move, with no error rendered anywhere and nothing in the state.

set() now folds through the existing runSubmit helper and returns
Result<string, void>, reloading either way so the state still reflects the
server. The page awaits it and renders the failure in an app-alert.

Found by the CQRS-light pass (CQ-002/CQ-004) as one of three mutations that
reach the raw ApiClient without producing a Result — the baseline's BL-007
inventory had missed all three.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/shared/docs/behaviour-spec.mdx

@@ -21,7 +21,7 @@ tested where._
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
 **is** the suite, reshaped for a business reader. 402 frontend behaviours across
-8 contexts; 217 backend behaviours across 36 test
+8 contexts; 221 backend behaviours across 37 test
 classes.
 
 ## Frontend (by context)
@@ -1049,6 +1049,13 @@ classes.
 - Proefbrief is admin only
 - Proefbrief renders the draft template with a watermark
 
+### ProfessionsTests
+
+- A mapping is absent before its geldigVan
+- A mapping is present on and after its geldigVan
+- A closed mapping is absent from its geldigTot onwards
+- ByProgram is evaluated per call not captured at type load
+
 ### StamdataEndpointTests
 
 - Stamdata reads are admin only