Rijkshuisstijl restyle + wizard fixes

Chrome: two-tier Rijksoverheid header (white brand bar + lint-blue
breadcrumb bar, route-driven), dark multi-column footer, white page
surface. Session shown via a shared SESSION_PORT token (keeps shared/
free of the auth context).

Overview ("Mijn overzicht") rebuilt to the NL Design System #392 pattern:
side-nav + "Wat moet ik regelen" task list (derived) + "Mijn registratie"
cards. New shared components: card, task-list, side-nav; pure
tasksFromProfile (+spec).

Wizards: grey form panel, connected numbered stepper, form-field
"(verplicht)" markers + styled description/error, full-width inputs.
Propagated to login, detail, change-request, address-fields.

Bug fixes:
- wizard-shell: add FormsModule so NgForm intercepts submit (wizards now
  advance; no native GET leaking choices into the URL).
- wizard-shell: error-summary links focus the field instead of navigating
  (a fragment href resolved against <base href="/"> reloaded to "/" and
  bounced to login).
- wizard-shell: error-summary focus only on the rising edge, so typing
  while errors are shown no longer scrolls the page up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/application/session.port.ts

@@ -0,0 +1,14 @@
+import { InjectionToken, Signal } from '@angular/core';
+
+/**
+ * A shared seam for the chrome to show "who is logged in" + log out, WITHOUT
+ * shared/ depending on the auth context (the import-direction rule forbids that).
+ * Auth provides this token at the app root (see app.config.ts); the shared header
+ * injects it. SessionStore satisfies this shape structurally.
+ */
+export interface SessionPort {
+  readonly session: Signal<{ naam: string } | null>;
+  logout(): void;
+}
+
+export const SESSION_PORT = new InjectionToken<SessionPort>('SESSION_PORT');