feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

eslint.config.mjs

@@ -7,7 +7,8 @@ import angular from 'angular-eslint';
  * direction (herregistratie → registratie → shared, auth/brief/beheer → shared; shared
  * depends on nothing), `domain/` framework-freedom, `contracts/` purity, `ui ↛
  * infrastructure`, and ApiClient confinement — moved to **dependency-cruiser** (WP-38,
- * `.dependency-cruiser.js`): one declarative source that also emits the architecture graph
+ * `.dependency-cruiser.base.js` + one thin per-app config, WP-67): one declarative source
+ * (per app) that also emits the architecture graph
  * (`npm run dep:graph`) and is enforced by `npm run dep:check` (in CI). That replaced the
  * per-context `no-restricted-imports` blocks that had to be hand-copied (and had left
  * `herregistratie` uncovered).
@@ -17,16 +18,16 @@ export default [
     ignores: [
       'dist/**',
       'node_modules/**',
-      'storybook-static/**',
+      'storybook-static*/**',
       '.angular/**',
       'coverage/**',
       'backend/**',
       // Generated client — owns its own /* eslint-disable */ header.
-      'src/app/shared/infrastructure/api-client.ts',
+      'libs/shared/src/infrastructure/api-client.ts',
     ],
   },
   {
-    files: ['src/**/*.ts'],
+    files: ['{apps,libs}/**/*.ts'],
     languageOptions: {
       parser: tseslint.parser,
       parserOptions: { ecmaVersion: 'latest', sourceType: 'module' },
@@ -35,7 +36,7 @@ export default [
     rules: { '@typescript-eslint/no-explicit-any': 'error' },
     // This repo has no .html files — every template is inline. This processor
     // extracts each component's template string into a virtual `*.html` file,
-    // which the template-a11y block below (`files: ['src/**/*.html']`) then lints.
+    // which the template-a11y block below (`files: ['{apps,libs}/**/*.html']`) then lints.
     processor: angular.processInlineTemplates,
   },
 
@@ -43,11 +44,14 @@ export default [
   // (alt-text, label-has-associated-control, click/mouse-events-have-key-events,
   // interactive-supports-focus, valid-aria, no-autofocus, and more) linting the
   // virtual `.html` files the processor above extracts from inline templates.
-  ...angular.configs.templateAccessibility.map((c) => ({ ...c, files: ['src/**/*.html'] })),
+  ...angular.configs.templateAccessibility.map((c) => ({
+    ...c,
+    files: ['{apps,libs}/**/*.html'],
+  })),
 
   // Tests legitimately use `any` to feed invalid messages/states into reducers.
   {
-    files: ['src/**/*.spec.ts'],
+    files: ['{apps,libs}/**/*.spec.ts'],
     rules: { '@typescript-eslint/no-explicit-any': 'off' },
   },
 ];