feat(beheer): stamdata deletion protection — CI referential gate + editor expire/warn

CI gate (authoritative): generalize the dangling-reference test in StamdataValidationTests
into a declared, extensible reference list ("every declared reference into a stamdata key
resolves against the currently-valid stamdata"), starting with Diploma.Opleiding →
professions.program. Removing/renaming a referenced program, or expiring it while current
data still references it, fails the PR build (ADR-0004). Editor (fast feedback): confirm
before delete (warns a referenced row fails CI) and, for temporal tables, a "Sluiten per
vandaag" action that closes validity (geldigTot) — steering to expire over hard delete.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -92,6 +92,7 @@ for its existing violations, so every WP ends green.
 | [WP-45](WP-45-create-ssp-generator.md)         | `create-ssp` bootstrap generator (mechanise new-ssp)                               | 8 · platform/DX/showcase    | todo   |
 | [WP-46](WP-46-vitest-coverage.md)              | Vitest coverage (report + report-only thresholds)                                  | 8 · platform/DX/showcase    | done   |
 | [WP-47](WP-47-feature-flags.md)                | Runtime feature flags (catalog-in-code, admin toggle, FE+backend)                  | 8 · platform/DX/showcase    | done   |
+| [WP-48](WP-48-stamdata-deletion-protection.md) | Stamdata deletion protection (CI referential gate + editor expire/warn)            | 8 · platform/DX/showcase    | done   |
 
 Sequencing dependencies (stated in the WPs too): 01 before 10–15 (axe covers story churn);
 03/04 before 05–09 (boundaries stop new violations during refactors); 06 before 07 (typed

docs/project/backlog/WP-48-stamdata-deletion-protection.md

@@ -0,0 +1,40 @@
+# WP-48 — Stamdata deletion protection (referential integrity)
+
+Status: done
+Phase: 8 — platform/DX/showcase
+
+## Why
+
+Deleting a stamdata row that something relies on (e.g. a `professions.program` a diploma maps
+through) would silently break behaviour. Stamdata is config-as-code (PR-applied, CI-gated), so the
+authoritative guard belongs at the build gate; the editor gets a fast-feedback nudge.
+
+## Decisions (locked with the user)
+
+- **CI gate (authoritative) + editor warning (fast feedback).**
+- **Steer temporal rows toward expiring** (set `geldigTot`) over hard delete.
+
+## Outcome
+
+- **CI gate:** generalized the dangling-reference test in `StamdataValidationTests` into a declared,
+  extensible reference list (`StamdataRef` records) — "every declared reference into a stamdata key
+  resolves against the currently-valid stamdata." Today one entry: `Diploma.Opleiding →
+professions.program (valid today)`. Resolvers use the "valid today" view (`Professions.ByProgram`),
+  so removing/renaming a referenced program OR expiring it while current data still references it
+  **fails the PR build**; expiring once nothing current relies on it passes. Adding a future FK is
+  one list entry.
+- **Editor (fast feedback):** `stamdata-table-editor` now confirms before delete (`@@beheer.removeConfirm`
+  — warns that a referenced row fails CI and, for a dated table, to close validity instead) and, for
+  **temporal** tables, adds a **"Sluiten per vandaag"** action that sets `geldigTot` to today
+  (reusing `CellEdited`) — steering to expire over hard delete. CI stays the authority.
+
+## Acceptance criteria
+
+- [x] A delete/expire that orphans a declared reference fails the build gate (existing seed passes).
+- [x] Editor confirms deletes and offers expire (close validity) for temporal tables.
+- [x] `npm run ci` green (backend `dotnet test`, localized build).
+
+## Deferred (noted)
+
+A per-row "referenced" hint in the editor DTO (server-computed usage) — would let the editor warn on
+the _specific_ referenced rows rather than a generic confirm. Not needed for the authoritative gate.