feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -35,16 +35,17 @@ jobs:
         with:
           filters: |
             frontend:
-              - 'src/**'
+              - 'apps/**'
+              - 'libs/**'
               - 'public/**'
               - 'e2e/**'
               - 'scripts/**'
               - 'angular.json'
               - 'package*.json'
               - 'tsconfig*.json'
-              - '.storybook/**'
+              - '.storybook*/**'
               - 'eslint.config.mjs'
-              - '.dependency-cruiser.js'
+              - '.dependency-cruiser*.js'
               - '.github/workflows/**'
             backend:
               - 'backend/**'
@@ -104,16 +105,17 @@ jobs:
       - run: npm run dep:check
         if: needs.changes.outputs.frontend == 'true'
       # Showcase snippets must match their real source regions (WP-39, no drift).
-      - run: npm run gen:snippets && git diff --exit-code src/app/showcase/snippets.generated.ts
+      - run: npm run gen:snippets && git diff --exit-code apps/ssp/src/app/showcase/snippets.generated.ts
         if: needs.changes.outputs.frontend == 'true'
-      # Runs the full suite AND reports coverage (WP-46, report-only — no thresholds, so
-      # it can't fail on coverage; it still fails on a failing test, like `npm test` did).
+      # Runs the full suite (both apps + both shared libraries, WP-67) AND reports coverage
+      # (WP-46, report-only — no thresholds, so it can't fail on coverage; it still fails on
+      # a failing test, like `npm test` did).
       - run: npm run test:coverage
         if: needs.changes.outputs.frontend == 'true'
-      # --localize builds every configured locale (nl + en, angular.json's i18n
-      # block) in one pass; i18nMissingTranslation:"error" (angular.json) fails
-      # this step if messages.en.xlf is missing a unit the source (WP-20) gains.
-      - run: npx ng build --localize
+      # --localize builds every configured locale (nl + en, angular.json's i18n block) in one
+      # pass per app; i18nMissingTranslation:"error" (angular.json) fails this step if either
+      # app's messages.en.xlf is missing a unit its source (WP-20) or libs/shared gains.
+      - run: npx ng build ssp --localize && npx ng build behandelportal --localize
         if: needs.changes.outputs.frontend == 'true'
       # The shipped bundle must stay clean; dev-only advisories are excluded.
       - run: npm audit --omit=dev
@@ -300,5 +302,5 @@ jobs:
         if: (needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true') && steps.node-modules-cache.outputs.cache-hit != 'true'
       - run: npm run gen:api
         if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
-      - run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json
+      - run: git diff --exit-code libs/shared/src/infrastructure/api-client.ts backend/swagger.json
         if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'