feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,10 @@
 # ponytail: dev-server images (not multi-stage prod builds) — this is a demo.
-# `docker compose up` → app at http://localhost:4200 (LOCALIZED: nl at /, en at /en/, the header
-# language switcher works, and the dev `⚙ state` panel stays visible), Swagger at :5000/swagger.
-# The web container does a one-time `ng build --configuration development --localize` (development
-# config keeps isDevMode()=true so the dev tools render) then serves both locale bundles
-# statically (with /api proxied); for a fast HMR loop use `npm start` locally instead (nl at /).
+# `docker compose up` → SSP at http://localhost:4200, behandelportal at :4201 (both LOCALIZED:
+# nl at /, en at /en/; the SSP's header language switcher + dev `⚙ state` panel stay visible),
+# Swagger at :5000/swagger (one shared backend, WP-67). Each web container does a one-time
+# `ng build --configuration development --localize` (development config keeps isDevMode()=true
+# so the dev tools render) then serves both locale bundles statically (with /api proxied); for a
+# fast HMR loop use `npm start` / `npm run start:behandelportal` locally instead (nl at /).
 services:
   api:
     image: mcr.microsoft.com/dotnet/sdk:10.0
@@ -38,10 +39,11 @@ services:
     # once (`ng build --localize`) then serves them statically via scripts/serve-i18n.mjs
     # (per-locale SPA fallback + /api reverse-proxy → the api container), so the language
     # switcher actually switches. ponytail: `--no-fund --loglevel=error` silences npm 11 noise.
-    command: sh -c "npm ci --no-fund --loglevel=error && npx ng build --configuration development --localize && node scripts/serve-i18n.mjs"
+    command: sh -c "npm ci --no-fund --loglevel=error && npx ng build ssp --configuration development --localize && node scripts/serve-i18n.mjs"
     environment:
       - PORT=4200
       - API_PROXY_TARGET=http://api:5000
+      - APP_DIST_ROOT=dist/ssp/browser
     volumes:
       - ./:/app:z
       - web-modules:/app/node_modules
@@ -50,7 +52,24 @@ services:
     depends_on:
       - api
 
+  web-behandelportal:
+    image: node:24-slim
+    working_dir: /app
+    command: sh -c "npm ci --no-fund --loglevel=error && npx ng build behandelportal --configuration development --localize && node scripts/serve-i18n.mjs"
+    environment:
+      - PORT=4201
+      - API_PROXY_TARGET=http://api:5000
+      - APP_DIST_ROOT=dist/behandelportal/browser
+    volumes:
+      - ./:/app:z
+      - web-behandelportal-modules:/app/node_modules
+    ports:
+      - '4201:4201'
+    depends_on:
+      - api
+
 volumes:
   api-bin:
   api-obj:
   web-modules:
+  web-behandelportal-modules: