feat(WP-67): merge behandelportal into this repo as a monorepo

Restructures into apps/ssp + apps/behandelportal (two Angular projects)
plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's
separate sibling repo. That split had already produced real drift: a
hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree
forked and silently diverging (7 files), and beheer + the styles.scss
token bridge duplicated byte-for-byte across both repos.

- git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/,
  environments/, the Storybook docs/*.mdx, and styles.scss into
  libs/shared + libs/beheer (all confirmed identical between the two
  repos before merging). auth stays deliberately duplicated per
  ADR-0002 (actor-specific, expected to diverge) - amended there.
- One generated API client (libs/shared), no more vendored swagger.json.
- .dependency-cruiser split into a base factory + one config per app,
  and Storybook into .storybook-ssp/.storybook-behandelportal - both
  forced by the @auth/* alias resolving to different directories per app.
- SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/
  HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies
  its own nav/admin-links/dev-panel instead of one being hardcoded.
- CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated;
  WP-67 backlog entry documents the full decision trail.

npm run ci green (lint, dep:check x2, 360 tests across ssp/
behandelportal/shared/beheer, both localized builds, backend tests,
snippet + api-client drift); both dev servers, both Storybook
instances, and docker compose verified working.

The old sibling repo (/home/eho/repos/behandelportal) is left
untouched, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/gen-snippets.mjs

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
 // Extract `// #region showcase:<name>` … `// #endregion showcase:<name>` blocks from real
-// source files into src/app/showcase/snippets.generated.ts (WP-39). The teaching showcase
-// renders these, so the code it shows IS the code that ships — it can't drift. A CI drift
-// gate (`npm run gen:snippets && git diff --exit-code`) forces a regen after any edit to a
-// marked region. Mirrors the gen:api pattern. Run: `npm run gen:snippets`.
+// source files into apps/ssp/src/app/showcase/snippets.generated.ts (WP-39). showcase is
+// SSP-only (CLAUDE.md), so this stays scoped to that app + the shared library. The teaching
+// showcase renders these, so the code it shows IS the code that ships — it can't drift. A CI
+// drift gate (`npm run gen:snippets && git diff --exit-code`) forces a regen after any edit to
+// a marked region. Mirrors the gen:api pattern. Run: `npm run gen:snippets`.
 import { readFileSync, writeFileSync } from 'node:fs';
 
 // Real source files that carry showcase regions. Add a file here + a #region marker there
 // to expose a new snippet; no other change needed.
 const SOURCES = [
-  'src/app/registratie/domain/registration.ts',
-  'src/app/shared/application/remote-data.ts',
-  'src/app/registratie/domain/value-objects/postcode.ts',
-  'src/app/registratie/domain/change-request.machine.ts',
-  'src/app/herregistratie/domain/intake.machine.ts',
-  'src/app/shared/kernel/bsn.ts',
-  'src/app/shared/kernel/pii.ts',
+  'apps/ssp/src/app/registratie/domain/registration.ts',
+  'libs/shared/src/application/remote-data.ts',
+  'apps/ssp/src/app/registratie/domain/value-objects/postcode.ts',
+  'apps/ssp/src/app/registratie/domain/change-request.machine.ts',
+  'apps/ssp/src/app/herregistratie/domain/intake.machine.ts',
+  'libs/shared/src/kernel/bsn.ts',
+  'libs/shared/src/kernel/pii.ts',
 ];
 
 const START = /\/\/\s*#region showcase:([\w-]+)/;
@@ -62,7 +63,7 @@ export const SNIPPETS: Record<string, string> = {
 ${body}
 };
 `;
-writeFileSync('src/app/showcase/snippets.generated.ts', out);
+writeFileSync('apps/ssp/src/app/showcase/snippets.generated.ts', out);
 console.log(
-  `wrote src/app/showcase/snippets.generated.ts (${names.length} snippets: ${names.join(', ')})`,
+  `wrote apps/ssp/src/app/showcase/snippets.generated.ts (${names.length} snippets: ${names.join(', ')})`,
 );