Upload feature (a): BFF endpoints + category config + tests

- Domain/Documents: server-owned category config per wizard + authoritative
  type/size validation (DocumentRules).
- Data/DocumentStore: in-memory metadata store (no file bytes/PII) + audit log;
  user delete (owner-scoped, 409 once linked), admin delete (role seam via
  X-Admin header), link-on-submit, poll-by-localId status.
- Program.cs: GET /uploads/categories, POST /uploads (multipart, excluded from
  OpenAPI — hand-written on FE), GET /uploads/status, DELETE /uploads/{id},
  DELETE /admin/uploads/{id}. Submit links digital docs + records post-delivery.
- Contracts extended (DocumentRefDto on registratie/herregistratie submit);
  regenerated NSwag client + swagger.json (drift check stays green).
- Tests: 16 new (endpoints + DocumentRules); dotnet test 44/44.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Mappers.cs

@@ -1,4 +1,5 @@
 using BigRegister.Domain.Diplomas;
+using BigRegister.Domain.Documents;
 using BigRegister.Domain.People;
 using BigRegister.Domain.Registrations;
 
@@ -30,4 +31,7 @@ public static class Mappers
         d.Id, d.Naam, d.Instelling, d.Jaar,
         DiplomaRules.ProfessionFor(d),
         DiplomaRules.QuestionsFor(d).Select(q => q.ToDto()).ToList());
+
+    public static DocumentCategoryDto ToDto(this DocumentCategory c) => new(
+        c.CategoryId, c.Label, c.Description, c.Required, c.AcceptedTypes, c.MaxSizeMb, c.Multiple, c.AllowPostDelivery);
 }