feat(backend): expand stamdata + OpenZaak-ready cases seam (WP-49)

Stamdata: add beroepen, opleidingen (temporal), and specialismen tables to the
schema-driven catalog (zero UI code). opleidingen.beroep and specialismen.beroep
both reference beroepen.code — the first stamdata->stamdata references, enforced by
two new StamdataRef entries in the CI gate.

OpenZaak/ZGW (WP-49, slice 1 — read-only zaken): introduce IZaakSource as the cases
read seam. Default LocalZaakSource reads the local SQLite store (offline); an
OpenZaakZaakSource (Zgw/ client: HS256 per-call JWT, ZGW->existing-DTO mapper,
paginating HTTP source) is selected behind Zgw:Enabled (default false). The FE never
changes — same ApplicationSummaryDto, no api-client drift. Unit-tested with fixtures
+ a stub HttpMessageHandler; no live OpenZaak needed.

Docs: ADR-0005, reference/openzaak-integration.md, WP-49..52 roadmap, stamdata.md
update, README index rows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/IZaakSource.cs

@@ -0,0 +1,21 @@
+using BigRegister.Api.Contracts;
+
+namespace BigRegister.Api.Data;
+
+/// <summary>
+/// The cases (zaken) READ seam (WP-49). A "zaak" in ZGW terms is an <see cref="Aanvraag"/>
+/// here; this interface is the one injection point that lets a real ZGW backend (OpenZaak)
+/// replace the local SQLite store <em>behind the same <see cref="ApplicationSummaryDto"/>
+/// contract</em> — so the frontend never changes (BFF-lite anti-corruption, ADR-0001).
+///
+/// Default binding is <see cref="LocalZaakSource"/> (offline). Setting <c>Zgw:Enabled=true</c>
+/// swaps in <c>OpenZaakZaakSource</c>. Slice 1 is read-only; create/update stay on the
+/// local write path until WP-50. The interface returns the wire DTO (not the domain
+/// <see cref="Aanvraag"/>) precisely so each source owns its own mapping — the OpenZaak
+/// source maps a ZGW Zaak into this shape, the local source maps the stored aanvraag.
+/// </summary>
+public interface IZaakSource
+{
+  /// <summary>Every case, newest-first (the admin cross-owner list, WP-36).</summary>
+  IReadOnlyList<ApplicationSummaryDto> ListCases(DateTimeOffset now);
+}

backend/src/BigRegister.Api/Data/LocalZaakSource.cs

@@ -0,0 +1,15 @@
+using BigRegister.Api.Contracts;
+
+namespace BigRegister.Api.Data;
+
+/// <summary>
+/// The default <see cref="IZaakSource"/> — the cases come from the local SQLite
+/// <see cref="ApplicationStore"/>, exactly as before the seam existed (WP-49). Zero
+/// behaviour change: this is the same <c>ListAll().ToAdminSummaryDto(now)</c> the
+/// <c>/admin/cases</c> endpoint used to call inline.
+/// </summary>
+public sealed class LocalZaakSource : IZaakSource
+{
+  public IReadOnlyList<ApplicationSummaryDto> ListCases(DateTimeOffset now) =>
+      ApplicationStore.ListAll().Select(a => a.ToAdminSummaryDto(now)).ToList();
+}