feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/infrastructure/me.adapter.ts

@@ -0,0 +1,41 @@
+import { Injectable, inject, resource } from '@angular/core';
+import { Result, ok, err } from '@shared/kernel/fp';
+import { Capability } from '@shared/domain/capability';
+import { ApiClient } from '@shared/infrastructure/api-client';
+
+const KNOWN: readonly Capability[] = [
+  'brief:approve',
+  'brief:reject',
+  'brief:send',
+  'orgtemplate:edit',
+  'stamdata:edit',
+  'cases:manage',
+  'flags:manage',
+];
+
+/**
+ * Infrastructure adapter for `GET /me` (PRD-0002 §6): the current principal's
+ * coarse, role-derived capabilities — nav/menu-level, not tied to any one screen's
+ * live status (contrast a screen's own decision DTO, e.g. `BriefViewDto.decisions`).
+ */
+@Injectable({ providedIn: 'root' })
+export class MeAdapter {
+  private client = inject(ApiClient);
+
+  meResource() {
+    return resource({ loader: () => this.client.me() });
+  }
+}
+
+/**
+ * Trust-boundary parse. An unrecognized capability string is dropped rather than
+ * rejecting the whole response — deny-by-default already covers it (AccessStore.can
+ * returns false for anything not in the set), and it lets the backend grow the
+ * capability list without breaking an older FE build.
+ */
+export function parseMe(json: unknown): Result<string, Capability[]> {
+  if (typeof json !== 'object' || json === null) return err('me: not an object');
+  const dto = json as { capabilities?: unknown };
+  if (!Array.isArray(dto.capabilities)) return err('me: missing/invalid capabilities');
+  return ok(dto.capabilities.filter((c): c is Capability => KNOWN.includes(c as Capability)));
+}