Architect-review remediation: enforce conventions, prod-safe tooling, one form idiom, resilience seams

Acts on the showcase review. Four workstreams; all tests green
(npm run lint, 70 FE tests, ng build, 33 backend tests).

Enforcement + CI:
- eslint.config.mjs bans `any` and enforces layer/context boundaries
  (domain ≠ Angular; herregistratie → registratie → shared, auth → shared);
  `npm run lint` added; ajv 6 scoped to ESLint via nested override.
- .github/workflows/ci.yml: FE lint+check:tokens+test+build, backend dotnet test,
  and an API-client drift check.

One form idiom (the headline finding):
- change-request-form converged onto the wizard pattern — change-request.machine.ts
  (Model/Msg/reduce + value objects) + submit-change-request.ts (Result) + a real
  POST /api/v1/change-requests (server re-validates). Spec + story added; the detail
  page no longer holds an ad-hoc success signal.

Resilience/observability seam:
- api-client.provider.ts: request timeout, X-Correlation-Id, Idempotency-Key for
  writes; comments naming the retry/auth seams.
- Backend logs correlation id + a no-PII submit-audit line; /api/v1 prefix +
  backward-compat note; client regenerated.

Quick wins:
- Dev tooling excluded from prod: scenario.interceptor wired only under isDevMode()
  (?scenario= inert in prod); debug panel @if(isDev) (tree-shaken out).
- src/environments + apiBaseUrl into provideApiClient (angular.json fileReplacements).
- Backend /health + /health/ready.
- Debug view PII-minimised (redactProfile: name/address/DOB redacted, BIG masked).
- IntakePolicyAdapter (removes inline resource in the intake wizard).
- README de-staled; CLAUDE.md gains EN/NL + forms-one-idiom + lint/CI notes.
- Stories: text-input, link, data-row, site-header, site-footer, change-request-form.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Domain/Submissions/SubmissionRules.cs

@@ -1,3 +1,5 @@
+using System.Text.RegularExpressions;
+
 namespace BigRegister.Domain.Submissions;
 
 /// <summary>
@@ -17,6 +19,18 @@ public static class SubmissionRules
     public static string? RejectZeroUren(int uren) =>
         uren == 0 ? "Aanvraag afgewezen: geen gewerkte uren geregistreerd." : null;
 
+    private static readonly Regex PostcodePattern =
+        new(@"^[1-9]\d{3}\s?[A-Z]{2}$", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    // RULE: a change request needs a street and a well-formed Dutch postcode. The
+    // server re-validates format authoritatively (the FE check is UX-only).
+    public static string? RejectChangeRequest(string straat, string postcode)
+    {
+        if (string.IsNullOrWhiteSpace(straat)) return "Vul straat en huisnummer in.";
+        if (!PostcodePattern.IsMatch(postcode?.Trim() ?? "")) return "Voer een geldige postcode in, bijv. 1234 AB.";
+        return null;
+    }
+
     public static string NewReference() =>
         // ponytail: random reference is fine for a demo; a real system reserves it transactionally.
         "BIG-2026-" + Random.Shared.Next(100_000, 1_000_000);