feat(admin): runtime feature flags (catalog-in-code, admin toggle, FE+backend)

Catalog declared in code (Domain/Features/FeatureFlags.cs, build-validated), on/off state
persisted in SQLite (FeatureFlagStore + migration). GET /flags (drives FE gating) + admin
PUT /admin/flags/{key} (new flags:manage capability + FlagsAdmin gate). Enforced end-to-end:
the `inschrijving-open` flag hides the Inschrijven nav item + dashboard action (FE) AND makes
POST /applications for a registratie 403 when off (backend). FE FeatureFlagStore mirrors
AccessStore (enabled() deny-by-default); admin toggle page at /beheer/functies in ADMIN_LINKS.
+4 backend tests, /me cap-list updated, client regenerated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -83,6 +83,10 @@ public sealed record ChangeRequestRequest(string Telefoon);
 public sealed record AuthzAuditDto(
     string At, string Action, string Resource, string Decision, string Role, string CorrelationId);
 
+// Feature flags (WP-47): the resolved flag set + the admin toggle body.
+public sealed record FeatureFlagDto(string Key, string Description, bool Enabled);
+public sealed record SetFeatureFlagRequest(bool Enabled);
+
 public sealed record ReferentieResponse(string Referentie);
 
 // --- Applications (aanvragen): the system of record for the dashboard. ---