feat(arch): WP-38 — dependency graph + declarative boundaries (dependency-cruiser)

Adopt dependency-cruiser as the single declarative source for bounded-context +
atomic-layer boundaries, replacing the per-context no-restricted-imports blocks that
had to be hand-copied (and had left herregistratie uncovered). `.dependency-cruiser.js`
encodes context direction (everyone→shared, herregistratie→registratie, showcase→*),
domain-purity, contracts-import-nothing, ui↛infrastructure, ApiClient confinement, and
no-circular. `npm run dep:check` enforces (wired into ci-local.sh + the frontend CI job);
`npm run dep:graph` emits a committed mermaid context×layer graph. ESLint slimmed to
no-explicit-any + template a11y. Docs + new-context skill updated to the single source.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/WP-38-dependency-graph-boundaries.md

@@ -1,9 +1,20 @@
 # WP-38 — Dependency graph + declarative boundaries
 
-Status: todo
+Status: done
 Phase: 8 — platform/DX/showcase
 Priority: P1
 
+## Outcome
+
+Adopted **dependency-cruiser**. `.dependency-cruiser.js` is the single declarative source for
+context + layer boundaries (incl. the previously-missing `herregistratie` scope + no-circular);
+`npm run dep:check` enforces (wired into `ci-local.sh` + the `frontend` CI job), `npm run dep:graph`
+emits a mermaid context×layer graph to `docs/reference/architecture/dependency-graph.md`. The
+per-context `no-restricted-imports` blocks were **removed** from `eslint.config.mjs` (now only
+`no-explicit-any` + template a11y remain); parity verified by planting violations (domain→Angular,
+beheer→registratie incl. type-only) and confirming `dep:check` flags them. Doc:
+`docs/reference/architecture/dependencies.md`; `new-context` skill updated to the single source.
+
 ## Why
 
 Bounded-context + atomic-layer boundaries are enforced only by hand-duplicated
@@ -32,7 +43,7 @@ showcase`; layers `domain/application/infrastructure/contracts/ui`); **fix the h
 
 ## Acceptance criteria
 
-- [ ] One declarative config expresses all allowed context/layer edges; herregistratie included.
-- [ ] `npm run graph` produces an architecture graph (SVG/HTML); validate runs in `npm run ci`.
-- [ ] A deliberately-illegal import fails the validate step (proven, then reverted).
-- [ ] No loss of enforcement vs the old ESLint blocks; `npm run ci` green.
+- [x] One declarative config expresses all allowed context/layer edges; herregistratie included.
+- [x] `npm run dep:graph` produces a committed mermaid architecture graph; `dep:check` runs in `npm run ci`.
+- [x] A deliberately-illegal import fails the validate step (proven, then reverted).
+- [x] No loss of enforcement vs the old ESLint blocks; `npm run ci` green.