Upload feature (a): BFF endpoints + category config + tests

- Domain/Documents: server-owned category config per wizard + authoritative
  type/size validation (DocumentRules).
- Data/DocumentStore: in-memory metadata store (no file bytes/PII) + audit log;
  user delete (owner-scoped, 409 once linked), admin delete (role seam via
  X-Admin header), link-on-submit, poll-by-localId status.
- Program.cs: GET /uploads/categories, POST /uploads (multipart, excluded from
  OpenAPI — hand-written on FE), GET /uploads/status, DELETE /uploads/{id},
  DELETE /admin/uploads/{id}. Submit links digital docs + records post-delivery.
- Contracts extended (DocumentRefDto on registratie/herregistratie submit);
  regenerated NSwag client + swagger.json (drift check stays green).
- Tests: 16 new (endpoints + DocumentRules); dotnet test 44/44.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/RuleTests.cs

@@ -1,9 +1,38 @@
 using BigRegister.Domain.Diplomas;
+using BigRegister.Domain.Documents;
 using BigRegister.Domain.Registrations;
 using BigRegister.Domain.Submissions;
 
 namespace BigRegister.Tests;
 
+public class DocumentRuleTests
+{
+    [Fact]
+    public void Rejects_unknown_category() =>
+        Assert.NotNull(DocumentRules.RejectUpload(null, "application/pdf", 1));
+
+    [Fact]
+    public void Rejects_disallowed_type()
+    {
+        var c = DocumentRules.Find("registratie", "diploma");
+        Assert.NotNull(DocumentRules.RejectUpload(c, "text/plain", 1));
+    }
+
+    [Fact]
+    public void Rejects_oversized_file()
+    {
+        var c = DocumentRules.Find("registratie", "diploma");
+        Assert.NotNull(DocumentRules.RejectUpload(c, "application/pdf", 11L * 1024 * 1024));
+    }
+
+    [Fact]
+    public void Accepts_valid_file()
+    {
+        var c = DocumentRules.Find("registratie", "diploma");
+        Assert.Null(DocumentRules.RejectUpload(c, "application/pdf", 5L * 1024 * 1024));
+    }
+}
+
 public class HerregistratieRuleTests
 {
     private static Registration Active(DateOnly deadline) => new(