feat: implement strangler-fig-demo Session 1 (backend + smoke script)

Builds the four-seam, three-write-path reference demo backend: case-framework
(seam D stand-in), legacy-backend/frontend (SQL Server, seams A/B/C targets),
and new-backend (Domain/Application/Infrastructure.*/Api implementing the
source resolver, take/release-ownership, write-through translator, and owned
assessment flow), wired together via docker-compose with a plain placeholder
frontend standing in for the Angular portal until Session 2.

All 11 Architecture.Tests pass and scripts/smoke.sh passes end-to-end against
a fresh `docker compose up`, covering acceptance criteria 1-3 and 7-22.

Fixes two real domain bugs found only once the stack ran for real: the BSN
eleven-proof checksum trivially passes all-zero digits, and the adoption
mapper silently treated a partial legacy address as absent instead of failing
loudly. Also fixes several environment-specific integration issues (rootless
Podman/SELinux bind-mount permissions, a buildah NuGet layer-caching bug,
SqlClient's invariant-globalization incompatibility, and an nginx path-prefix
mismatch for the legacy frontend).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proxy/nginx.conf

@@ -0,0 +1,34 @@
+worker_processes 1;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include       mime.types;
+  default_type  application/octet-stream;
+  sendfile      on;
+
+  server {
+    listen 80;
+
+    location /api/ {
+      proxy_pass http://new-backend:8080/api/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Demo-User $http_x_demo_user;
+    }
+
+    # Legacy.Web's own routes are "/legacy" and "/legacy/aanvraag/{id}/...",
+    # so the prefix is forwarded as-is (no trailing slash on proxy_pass,
+    # and no trailing slash on the location so a bare "/legacy" matches too).
+    location /legacy {
+      proxy_pass http://legacy-frontend:8080;
+      proxy_set_header Host $host;
+    }
+
+    location / {
+      proxy_pass http://new-frontend:80/;
+      proxy_set_header Host $host;
+    }
+  }
+}