feat: implement strangler-fig-demo Session 1 (backend + smoke script)

Builds the four-seam, three-write-path reference demo backend: case-framework
(seam D stand-in), legacy-backend/frontend (SQL Server, seams A/B/C targets),
and new-backend (Domain/Application/Infrastructure.*/Api implementing the
source resolver, take/release-ownership, write-through translator, and owned
assessment flow), wired together via docker-compose with a plain placeholder
frontend standing in for the Angular portal until Session 2.

All 11 Architecture.Tests pass and scripts/smoke.sh passes end-to-end against
a fresh `docker compose up`, covering acceptance criteria 1-3 and 7-22.

Fixes two real domain bugs found only once the stack ran for real: the BSN
eleven-proof checksum trivially passes all-zero digits, and the adoption
mapper silently treated a partial legacy address as absent instead of failing
loudly. Also fixes several environment-specific integration issues (rootless
Podman/SELinux bind-mount permissions, a buildah NuGet layer-caching bug,
SqlClient's invariant-globalization incompatibility, and an nginx path-prefix
mismatch for the legacy frontend).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

new/src/New.Application/Ports/IApplicationSource.cs

@@ -0,0 +1,14 @@
+using New.Application.Worklist;
+
+namespace New.Application.Ports;
+
+/// <summary>
+/// Resolves a case by its legacy id transparently, regardless of whether it
+/// has been taken into ownership. Implemented by the (single) source
+/// resolver - see the composition root for why that type is the only one
+/// allowed to know both sources exist (Architecture.Tests rule 7).
+/// </summary>
+public interface IApplicationSource
+{
+    Task<CaseDetail?> GetByLegacyIdAsync(int aanvraagId, CancellationToken ct);
+}

new/src/New.Application/Ports/ICaseFrameworkGateway.cs

@@ -0,0 +1,25 @@
+namespace New.Application.Ports;
+
+public sealed record CaseCreated(Guid CaseId, string? ProcessStatus);
+
+public sealed record TaskCreated(Guid TaskId, bool Open);
+
+/// <summary>Seam D: the case-framework client port (New.Infrastructure.CaseFramework implements this).</summary>
+public interface ICaseFrameworkGateway
+{
+    Task<CaseCreated> CreateCaseAsync(string caseTypeCode, string externalReference, IReadOnlyList<string> participants, CancellationToken ct);
+
+    Task<string?> GetProcessStatusAsync(Guid caseId, CancellationToken ct);
+
+    Task<TaskCreated> CreateTaskAsync(Guid caseId, string code, string description, CancellationToken ct);
+
+    Task CompleteTaskAsync(Guid caseId, Guid taskId, CancellationToken ct);
+
+    /// <summary>
+    /// POST .../closure-request. Returns true if the case closed, false if
+    /// the framework returned 409 (an open task) - which is an expected,
+    /// non-exceptional outcome for callers (e.g. the owned assessment flow
+    /// treats it as "closure pending", not a failure).
+    /// </summary>
+    Task<bool> RequestClosureAsync(Guid caseId, CancellationToken ct);
+}

new/src/New.Application/Ports/ILegacyCaseGateway.cs

@@ -0,0 +1,39 @@
+using New.Application.WriteThrough;
+using New.Domain;
+
+namespace New.Application.Ports;
+
+public enum LegacyFetchStatus
+{
+    Found,
+    NotFound,
+}
+
+public sealed record LegacyFetchAndMapResult(LegacyFetchStatus Status, RegistrationApplication? Application);
+
+/// <summary>
+/// The legacy-facing operations needed by the take-ownership flow, the
+/// write-through edit seam, and ownership release - as opposed to
+/// <c>LegacyCaseSource</c> (seam A read, used only by the source resolver).
+/// Kept as a separate port/type from that read seam deliberately (see
+/// Architecture.Tests rule 7's remarks on the resolver's exclusivity).
+/// </summary>
+public interface ILegacyCaseGateway
+{
+    /// <summary>
+    /// Fetches the legacy case and maps it to a <see cref="RegistrationApplication"/>
+    /// via the internal mapper. A domain exception during mapping propagates
+    /// as-is (callers such as the take-ownership handler turn it into a 422) -
+    /// this method itself never swallows mapping failures.
+    /// </summary>
+    Task<LegacyFetchAndMapResult> FetchAndMapAsync(int aanvraagId, CancellationToken ct);
+
+    /// <summary>
+    /// Seam B: PUT .../gegevens. This is a pure translation - see
+    /// LegacyDetailsWriteThroughTranslator for the "no business rules" comment.
+    /// </summary>
+    Task<WriteThroughOutcome> UpdateDetailsAsync(int aanvraagId, ApplicantDetailsCommand command, CancellationToken ct);
+
+    /// <summary>PUT .../migratie-vlag. Used on take-ownership (true) and release-ownership (false).</summary>
+    Task SetMigratedFlagAsync(int aanvraagId, bool migrated, CancellationToken ct);
+}

new/src/New.Application/Ports/ILegacyWorklistReader.cs

@@ -0,0 +1,9 @@
+using New.Application.Worklist;
+
+namespace New.Application.Ports;
+
+/// <summary>Lists legacy applications (via seam A) for the merged worklist.</summary>
+public interface ILegacyWorklistReader
+{
+    Task<IReadOnlyList<WorklistItem>> ListAsync(CancellationToken ct);
+}

new/src/New.Application/Ports/IOwnedWorklistReader.cs

@@ -0,0 +1,14 @@
+using New.Application.Worklist;
+
+namespace New.Application.Ports;
+
+/// <summary>
+/// Lists owned applications for the merged worklist. Deliberately a
+/// different port/type than whatever the source resolver uses to fetch a
+/// single owned case by id - see Architecture.Tests rule 7's remarks on the
+/// resolver being the only type that reaches into both sources.
+/// </summary>
+public interface IOwnedWorklistReader
+{
+    Task<IReadOnlyList<WorklistItem>> ListAsync(CancellationToken ct);
+}

new/src/New.Application/Ports/IOwnershipRegistry.cs

@@ -0,0 +1,30 @@
+namespace New.Application.Ports;
+
+/// <summary>Read-model row of the `legacy_ownership` table.</summary>
+public sealed record OwnershipRecord(
+    int LegacyAanvraagId,
+    Guid RegistrationApplicationId,
+    DateTimeOffset TakenOverAt,
+    int DomainWritesSince);
+
+/// <summary>
+/// The `legacy_ownership` table - which legacy aanvraagen have been taken
+/// into ownership, and how many domain writes have happened since (which
+/// gates whether ownership can be released again).
+/// </summary>
+public interface IOwnershipRegistry
+{
+    /// <summary>Null if <paramref name="legacyAanvraagId"/> has not been taken into ownership.</summary>
+    Task<Guid?> LookupOwnedIdAsync(int legacyAanvraagId, CancellationToken ct);
+
+    Task<OwnershipRecord?> GetAsync(Guid registrationApplicationId, CancellationToken ct);
+
+    /// <summary>Stages a new ownership row (flushed by <see cref="IUnitOfWork.SaveChangesAsync"/>).</summary>
+    Task RecordAsync(int legacyAanvraagId, Guid registrationApplicationId, DateTimeOffset takenOverAt, CancellationToken ct);
+
+    /// <summary>Increments `domain_writes_since` for a domain write against an adopted aggregate.</summary>
+    Task IncrementDomainWritesAsync(Guid registrationApplicationId, CancellationToken ct);
+
+    /// <summary>Stages removal of the ownership row (flushed by <see cref="IUnitOfWork.SaveChangesAsync"/>).</summary>
+    Task RemoveAsync(Guid registrationApplicationId, CancellationToken ct);
+}

new/src/New.Application/Ports/IRegistrationApplicationRepository.cs

@@ -0,0 +1,15 @@
+using New.Domain;
+
+namespace New.Application.Ports;
+
+/// <summary>Owned-side persistence port for the <see cref="RegistrationApplication"/> aggregate.</summary>
+public interface IRegistrationApplicationRepository
+{
+    Task<RegistrationApplication?> GetAsync(Guid registrationApplicationId, CancellationToken ct);
+
+    /// <summary>Stages a brand-new aggregate for insertion (flushed on the next <see cref="IUnitOfWork.SaveChangesAsync"/>).</summary>
+    Task AddAsync(RegistrationApplication application, CancellationToken ct);
+
+    /// <summary>Stages an aggregate for deletion (flushed on the next <see cref="IUnitOfWork.SaveChangesAsync"/>).</summary>
+    Task RemoveAsync(RegistrationApplication application, CancellationToken ct);
+}

new/src/New.Application/Ports/IUnitOfWork.cs

@@ -0,0 +1,12 @@
+namespace New.Application.Ports;
+
+/// <summary>
+/// Commits everything staged through <see cref="IRegistrationApplicationRepository"/>
+/// and <see cref="IOwnershipRegistry"/> in one local transaction. In the
+/// Persistence adapter both ports are backed by the same scoped DbContext, so
+/// a single SaveChangesAsync call is genuinely atomic across them.
+/// </summary>
+public interface IUnitOfWork
+{
+    Task SaveChangesAsync(CancellationToken ct);
+}