Architect-review remediation: enforce conventions, prod-safe tooling, one form idiom, resilience seams

Acts on the showcase review. Four workstreams; all tests green
(npm run lint, 70 FE tests, ng build, 33 backend tests).

Enforcement + CI:
- eslint.config.mjs bans `any` and enforces layer/context boundaries
  (domain ≠ Angular; herregistratie → registratie → shared, auth → shared);
  `npm run lint` added; ajv 6 scoped to ESLint via nested override.
- .github/workflows/ci.yml: FE lint+check:tokens+test+build, backend dotnet test,
  and an API-client drift check.

One form idiom (the headline finding):
- change-request-form converged onto the wizard pattern — change-request.machine.ts
  (Model/Msg/reduce + value objects) + submit-change-request.ts (Result) + a real
  POST /api/v1/change-requests (server re-validates). Spec + story added; the detail
  page no longer holds an ad-hoc success signal.

Resilience/observability seam:
- api-client.provider.ts: request timeout, X-Correlation-Id, Idempotency-Key for
  writes; comments naming the retry/auth seams.
- Backend logs correlation id + a no-PII submit-audit line; /api/v1 prefix +
  backward-compat note; client regenerated.

Quick wins:
- Dev tooling excluded from prod: scenario.interceptor wired only under isDevMode()
  (?scenario= inert in prod); debug panel @if(isDev) (tree-shaken out).
- src/environments + apiBaseUrl into provideApiClient (angular.json fileReplacements).
- Backend /health + /health/ready.
- Debug view PII-minimised (redactProfile: name/address/DOB redacted, BIG masked).
- IntakePolicyAdapter (removes inline resource in the intake wizard).
- README de-staled; CLAUDE.md gains EN/NL + forms-one-idiom + lint/CI notes.
- Stories: text-input, link, data-row, site-header, site-footer, change-request-form.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/ui/debug-state/debug-state.component.ts

@@ -3,7 +3,8 @@ import { JsonPipe } from '@angular/common';
 import { SessionStore } from '@auth/application/session.store';
 import { Session } from '@auth/domain/session';
 import { BigProfileStore } from '@registratie/application/big-profile.store';
-import { maskBsn } from './mask';
+import { map } from '@shared/application/remote-data';
+import { maskBsn, redactProfile } from './mask';
 
 /**
  * Dev-only "show the current Model" panel (Elm-debugger style, read-only).
@@ -48,9 +49,11 @@ export class DebugStateComponent {
   // on construction, so we must not instantiate it until the dev asks to look.
   private profileStore?: BigProfileStore;
 
+  // PII is redacted/masked here (see mask.ts): the panel inspects state SHAPE,
+  // never personal data — a deliberate habit for a PII-handling app.
   protected readonly snapshot = computed(() => ({
     session: maskSession(this.session.session()),
-    profile: this.profileStore?.profile(),
+    profile: this.profileStore ? map(this.profileStore.profile(), redactProfile) : undefined,
     decisions: this.profileStore?.decisions(),
     aantekeningen: this.profileStore?.aantekeningen(),
     pendingHerregistratie: this.profileStore?.pendingHerregistratie(),

src/app/shared/ui/debug-state/mask.ts

@@ -1,5 +1,34 @@
+import { BigProfile } from '@registratie/domain/big-profile';
+
+const REDACTED = '‹redacted›';
+
+/** Keep the last `keep` characters, mask the rest. */
+function maskTail(value: string, keep: number): string {
+  if (value.length <= keep) return '*'.repeat(value.length);
+  return '*'.repeat(value.length - keep) + value.slice(-keep);
+}
+
 /** Redact a BSN for the dev state view: keep the last 3 digits, mask the rest. */
 export function maskBsn(bsn: string): string {
-  if (bsn.length <= 3) return '*'.repeat(bsn.length);
-  return '*'.repeat(bsn.length - 3) + bsn.slice(-3);
+  return maskTail(bsn, 3);
+}
+
+/**
+ * Data minimisation for the dev "show the Model" panel: keep the structural /
+ * decision-relevant fields (status, beroep, dates of registration) but redact
+ * direct personal identifiers (name, address, date of birth) and mask the BIG
+ * number. The panel is for inspecting state SHAPE, never for reading PII.
+ */
+export function redactProfile(p: BigProfile): unknown {
+  return {
+    registration: {
+      bigNummer: maskTail(p.registration.bigNummer, 3),
+      naam: REDACTED,
+      beroep: p.registration.beroep,
+      registratiedatum: p.registration.registratiedatum,
+      geboortedatum: REDACTED,
+      status: p.registration.status,
+    },
+    person: { naam: REDACTED, geboortedatum: REDACTED, adres: REDACTED },
+  };
 }