Add ASP.NET Core backend hosting business rules; FE consumes via typed client

Move the authoritative business rules off the frontend into a real backend,
realising the BFF-lite + decision-DTO design (ADR-0001) that until now lived
only in static mock JSON.

Backend (backend/):
- ASP.NET Core (.NET 10) minimal API, contract-first, Swagger UI at /swagger.
- DDD Domain/ rules layer: profession derivation + applicable policy questions
  (DiplomaRules), herregistratie eligibility + reason (HerregistratieRule),
  scholing threshold (IntakePolicy), submit rejections + reference generation
  (SubmissionRules). In-memory seeded data, ProblemDetails (RFC 7807) errors.
- 27 xUnit tests: rule units + endpoint integration incl. BRP no-address and
  DUO not-found fallbacks and 422 submit paths.

Frontend (only infrastructure/ + contracts/ change, as the architecture promised):
- NSwag-generated typed client (api-client.ts), routed through Angular HttpClient
  via a small fetch adapter so the ?scenario= interceptor still applies.
- GET adapters use resource({ loader: client.x }); submit commands call the client
  and map ProblemDetails -> err. The hardcoded uren==0 / manual-diploma rules are
  deleted (now server-side). Domain, stores, UI and format validators unchanged.
- Deleted the now-dead public/mock/*.json.

Tooling/docs:
- npm start proxies /api -> backend; npm run gen:api regenerates the client;
  docker compose up runs both (bind mounts use :z for SELinux/Fedora).
- backend/README.md walkthrough: adding a policy question is a one-file backend
  change, no FE change, no client regen. Updated CLAUDE.md + ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/registratie/application/big-profile.store.ts

@@ -42,9 +42,10 @@ export class BigProfileStore {
   readonly decisions = computed<RemoteData<Err, HerregistratieDecisions>>(() => map(this.view(), (v) => v.decisions));
 
   /** Specialisms/notes stay a separate stream (they have their own empty state). */
-  readonly aantekeningen = computed<RemoteData<Err, Aantekening[]>>(() =>
-    fromResource(this.aantekeningenRes, (v) => v.length === 0),
-  );
+  readonly aantekeningen = computed<RemoteData<Err, Aantekening[]>>(() => {
+    const rd = fromResource(this.aantekeningenRes, (v) => !v || v.length === 0);
+    return rd.tag === 'Success' ? { tag: 'Success', value: rd.value ?? [] } : rd;
+  });
 
   // --- Optimistic herregistratie state, shared with the dashboard -----------
   private pending = signal(false);

src/app/registratie/application/submit-registratie.spec.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { submitRegistratie } from './submit-registratie';
+import { ApiClient } from '@shared/infrastructure/api-client';
+import { ValidRegistratie } from '@registratie/domain/registratie-wizard.machine';
+
+// Mocked at the client boundary: the rule itself lives server-side now, so these
+// tests only assert that the command maps the client's response onto a Result.
+const data = { diplomaHerkomst: 'duo' } as unknown as ValidRegistratie;
+
+describe('submitRegistratie', () => {
+  it('returns ok with the server reference on success', async () => {
+    const client = { registrations: async () => ({ referentie: 'BIG-2026-123456' }) } as unknown as ApiClient;
+    const r = await submitRegistratie(client, data);
+    expect(r).toEqual({ ok: true, value: 'BIG-2026-123456' });
+  });
+
+  it('returns err with the ProblemDetails detail when the server rejects (422)', async () => {
+    const client = {
+      registrations: async () => {
+        throw { detail: 'Handmatig diploma kan niet automatisch worden geverifieerd.', status: 422 };
+      },
+    } as unknown as ApiClient;
+    const r = await submitRegistratie(client, data);
+    expect(r.ok).toBe(false);
+    expect(r).toMatchObject({ error: expect.stringContaining('Handmatig diploma') });
+  });
+});

src/app/registratie/application/submit-registratie.ts

@@ -1,19 +1,20 @@
 import { Result, ok, err } from '@shared/kernel/fp';
 import { ValidRegistratie } from '@registratie/domain/registratie-wizard.machine';
+import { ApiClient } from '@shared/infrastructure/api-client';
+import { problemDetail } from '@shared/infrastructure/api-error';
 
 /**
- * Command: send the completed registration to the backend, which invokes the
- * domain command to create/finalize the registration aggregate. Returns a Result
- * so the caller branches on success/failure without try/catch; on success it
- * yields the confirmation reference (PRD §9). ponytail: faked with a timer; swap
- * for a real POST when there's an API. The "manually entered diploma" rule lets
- * the demo show the failure path.
+ * Command: POST the completed registration to the backend (`/api/registrations`),
+ * which re-validates and decides. The business rule that a manually entered
+ * diploma cannot be auto-verified now lives server-side; the backend returns it as
+ * a 422 ProblemDetails, which we surface as the error. On success it yields the
+ * server-generated confirmation reference (PRD §9).
  */
-export async function submitRegistratie(data: ValidRegistratie): Promise<Result<string, string>> {
-  await new Promise((r) => setTimeout(r, 800));
-  if (data.diplomaHerkomst === 'handmatig') {
-    return err('Een handmatig ingevoerd diploma kan niet automatisch worden geverifieerd. Uw aanvraag is doorgestuurd voor handmatige beoordeling.');
+export async function submitRegistratie(client: ApiClient, data: ValidRegistratie): Promise<Result<string, string>> {
+  try {
+    const res = await client.registrations({ diplomaHerkomst: data.diplomaHerkomst });
+    return ok(res.referentie ?? '');
+  } catch (e) {
+    return err(problemDetail(e, 'Het indienen is niet gelukt. Probeer het later opnieuw.'));
   }
-  const referentie = 'BIG-2026-' + Math.floor(100000 + Math.random() * 900000);
-  return ok(referentie);
 }