fix(portal-self-service): run checkAuth() at startup to end the login redirect loop (refs #67)

Without an app-init auth check, the DigiD callback (?code=…) was never processed, so
the guard kept seeing 'not authenticated' and re-triggered login — an infinite
redirect loop. Add withAppInitializerAuthCheck() so checkAuth() runs before the router
and guard, establishing the session on the callback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

libs/auth/src/lib/digid-auth.providers.ts

@@ -1,5 +1,10 @@
 import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
-import { authInterceptor, LogLevel, provideAuth } from 'angular-auth-oidc-client';
+import {
+  authInterceptor,
+  LogLevel,
+  provideAuth,
+  withAppInitializerAuthCheck,
+} from 'angular-auth-oidc-client';
 import { AuthService } from './auth.service';
 import { DigiadAuthService } from './digid-auth.service';
 
@@ -19,20 +24,25 @@ export interface DigiadAuthOptions {
  */
 export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProviders {
   return makeEnvironmentProviders([
-    provideAuth({
-      config: {
-        authority: options.authority,
-        redirectUrl: options.redirectUrl,
-        postLogoutRedirectUri: options.redirectUrl,
-        clientId: 'big-portal',
-        scope: 'openid profile',
-        responseType: 'code',
-        silentRenew: true,
-        useRefreshToken: true,
-        secureRoutes: [options.secureApiOrigin],
-        logLevel: LogLevel.Warn,
+    provideAuth(
+      {
+        config: {
+          authority: options.authority,
+          redirectUrl: options.redirectUrl,
+          postLogoutRedirectUri: options.redirectUrl,
+          clientId: 'big-portal',
+          scope: 'openid profile',
+          responseType: 'code',
+          silentRenew: true,
+          useRefreshToken: true,
+          secureRoutes: [options.secureApiOrigin],
+          logLevel: LogLevel.Warn,
+        },
       },
-    }),
+      // Run checkAuth() at startup so the DigiD callback (?code=…) is processed before the router
+      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
+      withAppInitializerAuthCheck(),
+    ),
     { provide: AuthService, useClass: DigiadAuthService },
   ]);
 }

libs/ui/src/index.ts

@@ -5,13 +5,7 @@
 // The Utrecht v3 components are NgModule-based (not standalone), so we re-export the module.
 // A standalone component consumes them by importing UtrechtComponentsModule in its `imports`
 // (CLAUDE.md §10 forbids *declaring* NgModules in our code, not consuming a third-party one).
-// The component classes are re-exported too so the AOT compiler can resolve the template
-// directives (utrecht-article, utrecht-button, …) through this barrel.
-export {
-  UtrechtArticle,
-  UtrechtButtonAttr,
-  UtrechtComponentsModule,
-  UtrechtDocument,
-  UtrechtHeading1,
-  UtrechtParagraph,
-} from '@utrecht/component-library-angular';
+// Re-export the whole Utrecht package: importing UtrechtComponentsModule pulls every component it
+// exports into the compiler's scope, so the AOT build needs all of them resolvable through this
+// barrel (a partial re-export fails with NG3004 for the first unused component).
+export * from '@utrecht/component-library-angular';