feat(backend): enforce the scholing threshold server-side (WP-69)

ADR-0001's own canonical "config value" example was unenforced: GET
/intake/policy echoed ScholingThreshold, but no request DTO carried a
scholing answer, so the server had nothing to re-validate. A crafted
POST could skip a requirement the wizard presents as mandatory.

IntakePolicy.RejectIncompleteScholing is the authority — three-valued
completeness (below threshold an answer is required; "nee" is legal and
still submits; punten only belong to a followed scholing), living in the
class that owns the constant so scripts/check-seam.sh keeps guarding the
FE/BE literal pair. Both submit paths call it; a violation 400s with
ProblemDetails and leaves the aanvraag a Concept. Gated on
Type == "intake" (the endpoint's switch lumps herregistratie with
intake, which has no scholing question), and guarded by `reject is null`
so a zero-uren submission is still decided on its merits.

Also fixes a live FE bug in the same rule: validateStep required punten
whenever scholingGevolgd was 'ja' regardless of lageUren, while the
template renders those fields only when lageUren — so answering 'ja'
then raising uren either blocked the user on an invisible field or
emitted aanvullendeScholing: undefined alongside punten. punten now
derives from aanvullendeScholing, so that combination is unrepresentable
in ValidIntake.

Note: EndpointTests' Worked_hours_submission_succeeds was itself
asserting the vulnerable payload ({ uren: 40 }, no answer) and needed a
complete answer added; the zero-hours rows are the ordering regression
net and are unmodified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/herregistratie/domain/intake.machine.spec.ts

@@ -142,6 +142,34 @@ describe('submit', () => {
     expect(withScholing.data.punten).toBe(200);
   });
 
+  it('does not require punten for a hidden question (WP-69 §6)', () => {
+    // scholingGevolgd is a stale 'ja' from when uren was low, but uren is now above
+    // threshold — the template hides the question, so punten must not be required either.
+    const good = expectTag(
+      submit(answering({ buitenlandGewerkt: 'nee', uren: '1500', scholingGevolgd: 'ja' })),
+      'Submitting',
+    );
+    expect(good.data.aanvullendeScholing).toBeUndefined();
+  });
+
+  it('drops punten when raising uren hides the question (WP-69 §6)', () => {
+    // Same stale answer, but this time punten was also filled in while uren was low.
+    const good = expectTag(
+      submit(
+        answering({
+          buitenlandGewerkt: 'nee',
+          uren: '1500',
+          scholingGevolgd: 'ja',
+          punten: '150',
+        }),
+      ),
+      'Submitting',
+    );
+    // ValidIntake stays honest: neither the stale 'ja' nor its punten leak through.
+    expect(good.data.aanvullendeScholing).toBeUndefined();
+    expect(good.data.punten).toBeUndefined();
+  });
+
   it('resolve maps Submitting to Submitted on a successful submit', () => {
     const submitting = submit(answering(complete));
     expect(resolve(submitting, ok(undefined)).tag).toBe('Submitted');