feat(arch): WP-38 — dependency graph + declarative boundaries (dependency-cruiser)

Adopt dependency-cruiser as the single declarative source for bounded-context +
atomic-layer boundaries, replacing the per-context no-restricted-imports blocks that
had to be hand-copied (and had left herregistratie uncovered). `.dependency-cruiser.js`
encodes context direction (everyone→shared, herregistratie→registratie, showcase→*),
domain-purity, contracts-import-nothing, ui↛infrastructure, ApiClient confinement, and
no-circular. `npm run dep:check` enforces (wired into ci-local.sh + the frontend CI job);
`npm run dep:graph` emits a committed mermaid context×layer graph. ESLint slimmed to
no-explicit-any + template a11y. Docs + new-context skill updated to the single source.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -82,7 +82,7 @@ for its existing violations, so every WP ends green.
 | [WP-35](WP-35-one-concept-per-type.md)         | One Concept per case type (server-enforced)                                       | 7 · refinements             | done   |
 | [WP-36](WP-36-admin-cases.md)                  | Admin cases page + admin delete                                                   | 7 · refinements             | done   |
 | [WP-37](WP-37-dev-switcher-reset.md)           | Dev-switcher reset fix (scenario/role URL param)                                  | 8 · platform/DX/showcase    | done   |
-| [WP-38](WP-38-dependency-graph-boundaries.md)  | Dependency graph + declarative boundaries (visualize + enforce)                   | 8 · platform/DX/showcase    | todo   |
+| [WP-38](WP-38-dependency-graph-boundaries.md)  | Dependency graph + declarative boundaries (visualize + enforce)                   | 8 · platform/DX/showcase    | done   |
 | [WP-39](WP-39-showcase-snippets-animations.md) | Showcase: linked code snippets + teaching animations                              | 8 · platform/DX/showcase    | todo   |
 | [WP-40](WP-40-pii-kernel.md)                   | PII kernel: branded `Bsn` VO (elfproef) + masked-value atom                       | 8 · platform/DX/showcase    | todo   |
 | [WP-41](WP-41-persisted-authz-audit.md)        | Persisted, queryable authz/PII-reveal audit (no PII)                              | 8 · platform/DX/showcase    | todo   |

docs/project/backlog/WP-38-dependency-graph-boundaries.md

@@ -1,9 +1,20 @@
 # WP-38 — Dependency graph + declarative boundaries
 
-Status: todo
+Status: done
 Phase: 8 — platform/DX/showcase
 Priority: P1
 
+## Outcome
+
+Adopted **dependency-cruiser**. `.dependency-cruiser.js` is the single declarative source for
+context + layer boundaries (incl. the previously-missing `herregistratie` scope + no-circular);
+`npm run dep:check` enforces (wired into `ci-local.sh` + the `frontend` CI job), `npm run dep:graph`
+emits a mermaid context×layer graph to `docs/reference/architecture/dependency-graph.md`. The
+per-context `no-restricted-imports` blocks were **removed** from `eslint.config.mjs` (now only
+`no-explicit-any` + template a11y remain); parity verified by planting violations (domain→Angular,
+beheer→registratie incl. type-only) and confirming `dep:check` flags them. Doc:
+`docs/reference/architecture/dependencies.md`; `new-context` skill updated to the single source.
+
 ## Why
 
 Bounded-context + atomic-layer boundaries are enforced only by hand-duplicated
@@ -32,7 +43,7 @@ showcase`; layers `domain/application/infrastructure/contracts/ui`); **fix the h
 
 ## Acceptance criteria
 
-- [ ] One declarative config expresses all allowed context/layer edges; herregistratie included.
-- [ ] `npm run graph` produces an architecture graph (SVG/HTML); validate runs in `npm run ci`.
-- [ ] A deliberately-illegal import fails the validate step (proven, then reverted).
-- [ ] No loss of enforcement vs the old ESLint blocks; `npm run ci` green.
+- [x] One declarative config expresses all allowed context/layer edges; herregistratie included.
+- [x] `npm run dep:graph` produces a committed mermaid architecture graph; `dep:check` runs in `npm run ci`.
+- [x] A deliberately-illegal import fails the validate step (proven, then reverted).
+- [x] No loss of enforcement vs the old ESLint blocks; `npm run ci` green.