fix(uploads): delete the dead POST /registrations (RB-06)

POST /registrations passed its Documents list straight to Submit, which calls
DocumentStore.Link on every digital documentId in it — and linking a document
blocks its owner from ever deleting it (DeleteOwned returns 409 Linked). That
path had no ForeignIds ownership check, so any authenticated citizen could
post another citizen's document id and permanently block them from deleting
their own diploma scan. POST /applications/{id}/submit, the endpoint actually
in use, has had that guard since it was written.

Deleted rather than guarded: the endpoint is dead. No frontend caller, and
the whole registratie flow goes through /applications/{id}/submit.
RegistratieRequest went with it, and so did SubmissionRules.RejectRegistratie
— reachable only from here, and contradicted by the live path, which treats a
handmatig diploma as "does not auto-approve" rather than a 422 rejection. Its
own message said as much while being returned as a rejection. That last part
is a judgement call beyond the ticket's wording; reverting the two
SubmissionRules hunks restores it in isolation.

Coverage moved rather than vanished: the problem+json shape assertion is now
on /change-requests (the other endpoint on the same Submit helper), and the
linked-delete 409 test goes through the real submit path.

swagger.json, the generated client and the behaviour spec regenerated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -74,7 +74,6 @@ public sealed record DocumentRefDto(string CategoryId, string Channel, string? D
 
 // Submit requests carry only the fields the server re-validates (UX-only fields
 // stay on the client). ponytail: a real submit would carry the full application.
-public sealed record RegistratieRequest(string DiplomaHerkomst, IReadOnlyList<DocumentRefDto>? Documents = null);
 
 public sealed record ChangeRequestRequest(string Telefoon);
 

backend/src/BigRegister.Api/Domain/Submissions/SubmissionRules.cs

@@ -9,12 +9,6 @@ namespace BigRegister.Domain.Submissions;
 /// </summary>
 public static class SubmissionRules
 {
-  // RULE: a manually entered diploma cannot be auto-verified.
-  public static string? RejectRegistratie(string diplomaHerkomst) =>
-      diplomaHerkomst == "handmatig"
-          ? "Een handmatig ingevoerd diploma kan niet automatisch worden geverifieerd. Uw aanvraag is doorgestuurd voor handmatige beoordeling."
-          : null;
-
   // RULE: an application reporting zero worked hours is rejected.
   public static string? RejectZeroUren(int uren) =>
       uren == 0 ? "Aanvraag afgewezen: geen gewerkte uren geregistreerd." : null;

backend/src/BigRegister.Api/Program.cs

@@ -185,11 +185,6 @@ api.MapGet("/stamdata/{table}", (string table, string? peildatum, HttpContext ct
 
 // --- POST: submits. The server is the authority; it re-validates and decides. ---
 
-api.MapPost("/registrations", (RegistratieRequest req, HttpContext ctx) =>
-    Submit(ctx, "registratie", SubmissionRules.RejectRegistratie(req.DiplomaHerkomst), req.Documents))
-.Produces<ReferentieResponse>()
-.ProducesProblem(StatusCodes.Status422UnprocessableEntity);
-
 api.MapPost("/change-requests", (ChangeRequestRequest req, HttpContext ctx) =>
     Submit(ctx, "telefoonwijziging", SubmissionRules.RejectPhoneChange(req.Telefoon)))
 .Produces<ReferentieResponse>()

backend/swagger.json

@@ -210,45 +210,6 @@
         }
       }
     },
-    "/api/v1/registrations": {
-      "post": {
-        "tags": [
-          "BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RegistratieRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "OK",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ReferentieResponse"
-                }
-              }
-            }
-          },
-          "422": {
-            "description": "Unprocessable Content",
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProblemDetails"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/api/v1/change-requests": {
       "post": {
         "tags": [
@@ -2468,23 +2429,6 @@
         },
         "additionalProperties": false
       },
-      "RegistratieRequest": {
-        "type": "object",
-        "properties": {
-          "diplomaHerkomst": {
-            "type": "string",
-            "nullable": true
-          },
-          "documents": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/DocumentRefDto"
-            },
-            "nullable": true
-          }
-        },
-        "additionalProperties": false
-      },
       "RegistrationDto": {
         "type": "object",
         "properties": {

backend/tests/BigRegister.Tests/Domain/SubmissionRuleTests.cs

@@ -4,14 +4,6 @@ namespace BigRegister.Tests.Domain;
 
 public class SubmissionRuleTests
 {
-  [Fact]
-  public void Manual_diploma_is_rejected() =>
-      Assert.NotNull(SubmissionRules.RejectRegistratie("handmatig"));
-
-  [Fact]
-  public void Duo_diploma_is_accepted() =>
-      Assert.Null(SubmissionRules.RejectRegistratie("duo"));
-
   [Fact]
   public void Zero_hours_is_rejected() =>
       Assert.NotNull(SubmissionRules.RejectZeroUren(0));

backend/tests/BigRegister.Tests/EndpointTests.cs

@@ -69,26 +69,6 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
     Assert.Equal(1000, dto.ScholingThreshold);
   }
 
-  [Fact]
-  public async Task Registration_with_duo_diploma_succeeds()
-  {
-    var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("duo"));
-    res.EnsureSuccessStatusCode();
-    var body = await res.Content.ReadFromJsonAsync<ReferentieResponse>();
-    Assert.NotNull(body);
-    Assert.StartsWith("BIG-2026-", body.Referentie);
-  }
-
-  [Fact]
-  public async Task Registration_with_manual_diploma_is_rejected_with_problem_details()
-  {
-    var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("handmatig"));
-    Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
-    var contentType = res.Content.Headers.ContentType;
-    Assert.NotNull(contentType);
-    Assert.Contains("application/problem+json", contentType.ToString());
-  }
-
   [Fact]
   public async Task Change_request_with_valid_phone_succeeds()
   {
@@ -101,11 +81,16 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
   }
 
   [Fact]
-  public async Task Change_request_with_bad_phone_is_rejected()
+  public async Task Change_request_with_bad_phone_is_rejected_with_problem_details()
   {
     var res = await _client.PostAsJsonAsync("/api/v1/change-requests",
         new { telefoon = "nope" });
     Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
+    // The Submit helper's rejection shape — was asserted through POST /registrations until
+    // RB-06 deleted it; /change-requests is the other endpoint on the same helper.
+    var contentType = res.Content.Headers.ContentType;
+    Assert.NotNull(contentType);
+    Assert.Contains("application/problem+json", contentType.ToString());
   }
 
   [Fact]
@@ -215,8 +200,12 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
   public async Task User_delete_blocked_with_409_once_linked_to_submission()
   {
     var doc = await Upload(Guid.NewGuid().ToString());
-    var submit = await _client.PostAsJsonAsync("/api/v1/registrations",
-        new RegistratieRequest("duo", new[] { new DocumentRefDto("diploma", "digital", doc.DocumentId) }));
+    // Through the real submit path (RB-06 deleted POST /registrations, which was the only
+    // other caller of DocumentStore.Link and had no ownership guard on it).
+    var created = await _client.PostAsJsonAsync("/api/v1/applications", new { type = "registratie" });
+    var aanvraag = (await created.Content.ReadFromJsonAsync<ApplicationDetailDto>())!;
+    var submit = await _client.PostAsJsonAsync($"/api/v1/applications/{aanvraag.Id}/submit",
+        new { diplomaHerkomst = "duo", documents = new[] { new DocumentRefDto("diploma", "digital", doc.DocumentId) } });
     submit.EnsureSuccessStatusCode();
     Assert.Equal(HttpStatusCode.Conflict, (await _client.DeleteAsync($"/api/v1/uploads/{doc.DocumentId}")).StatusCode);
   }