feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/dep-graph.sh

@@ -1,26 +1,41 @@
 #!/usr/bin/env bash
-# Regenerate the architecture dependency graph (WP-38) as a mermaid diagram embedded in a
-# markdown file, so it renders on the git host and can be linked from the docs. Contexts ×
-# atomic layers; edges are real imports. Boundaries are enforced separately by `npm run
-# dep:check`. Run this after a structural change; commit the result.
+# Regenerate the architecture dependency graph (WP-38, updated WP-67) as mermaid diagrams
+# embedded in a markdown file, so it renders on the git host and can be linked from the docs.
+# One diagram per app (ssp, behandelportal) plus the shared libraries — each app is cruised
+# separately since a single tsconfig can't resolve both apps' `@auth/*` alias at once (see
+# .dependency-cruiser.base.js). Boundaries are enforced separately by `npm run dep:check`.
+# Run this after a structural change; commit the result.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
 OUT=docs/reference/architecture/dependency-graph.md
 
+graph() {
+  local app="$1" root="$2"
+  npx depcruise "$root" libs \
+    --config ".dependency-cruiser.${app}.js" \
+    --collapse "^(apps/[^/]+/src/app|libs/[^/]+/src)/[^/]+" \
+    --output-type mermaid
+}
+
 {
   echo "# Dependency graph"
   echo
   echo "_Generated by \`npm run dep:graph\` — do not edit by hand._ Nodes are context × atomic"
-  echo "layer (\`src/app/<context>/<layer>\`); edges are real imports. The allowed edges are"
-  echo "enforced by \`npm run dep:check\` (dependency-cruiser); see [dependencies.md](./dependencies.md)."
+  echo "layer (\`apps/<app>/src/app/<context>/<layer>\` or \`libs/<lib>/src/<layer>\`); edges are"
+  echo "real imports. The allowed edges are enforced by \`npm run dep:check\` (dependency-cruiser,"
+  echo "one config per app — see [dependencies.md](./dependencies.md))."
+  echo
+  echo "## ssp"
   echo
   echo '```mermaid'
-  npx depcruise src/app \
-    --config .dependency-cruiser.js \
-    --include-only "^src/app/" \
-    --collapse "^src/app/[^/]+/[^/]+" \
-    --output-type mermaid
+  graph ssp apps/ssp/src
+  echo '```'
+  echo
+  echo "## behandelportal"
+  echo
+  echo '```mermaid'
+  graph behandelportal apps/behandelportal/src
   echo '```'
 } >"$OUT"