docs(test): make Given/When/Then the default BDD structure (WP-71)

bdd.mdx previously banned "Given/When/Then ceremony" outright, which
directly contradicted WP-70's own acceptance tests (Acceptance/
BesluitLifecycleTests.cs already used // Given/When/Then comments) and
the backend's organically-evolved PascalCase_snake_sentence convention,
which the doc gave zero guidance for. Reverses that rule: every test is
now structured Given -> When -> Then, with a genuinely empty phase
omitted rather than faked; present-tense declarative naming and the
one-behaviour-per-test rule are unchanged. ADR-0006 gets a cross-reference
so both documents agree everywhere, not just in acceptance tests.

Also closes out the doc's other named-but-unenforced rules found by the
audit: fixes the 5 files asserting rendered $localize copy instead of
the underlying tag/message-id (the compliant pattern already existed in
werkvoorraad-item-view.spec.ts), splits the multi-behaviour titles the
doc itself calls a smell (";", "and", "/"), and fixes bdd.mdx's own false
citation of registratie-wizard.machine.spec.ts as "one transition per
test" by actually splitting that test into one-transition-per-test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/BeoordelingTests.cs

@@ -245,20 +245,33 @@ public class BeoordelingTests(TestWebApplicationFactory factory) : IClassFixture
   }
 
   [Fact]
-  public async Task Unknown_id_404s_and_zorgverlener_is_forbidden()
+  public async Task Unknown_id_404s()
   {
+    // Given no case exists with this id.
+    // When a besluit is posted against it...
     var notFound = await PostBesluit("does-not-exist", new { besluit = "Goedkeuren" });
-    Assert.Equal(HttpStatusCode.NotFound, notFound.StatusCode);
 
+    // Then the endpoint answers 404, not a decision.
+    Assert.Equal(HttpStatusCode.NotFound, notFound.StatusCode);
+  }
+
+  [Fact]
+  public async Task Zorgverlener_is_forbidden_from_deciding()
+  {
+    // Given a decidable case.
     var (a, _) = await CreateManualCaseWithDocument();
     try
     {
+      // When a zorgverlener (no X-Medewerker) posts a besluit against it...
       var req = new HttpRequestMessage(HttpMethod.Post, $"/api/v1/beoordeling/{a.Id}/besluit")
       {
         Content = JsonContent.Create(new { besluit = "Goedkeuren" }),
       };
       req.Headers.Add("X-Role", "admin"); // zorgverlener, no X-Medewerker
-      Assert.Equal(HttpStatusCode.Forbidden, (await _client.SendAsync(req)).StatusCode);
+      var response = await _client.SendAsync(req);
+
+      // Then the request is forbidden — deciding is a behandelaar-only capability.
+      Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
     }
     finally
     {