feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/behandelportal/src/app/app.routes.ts

@@ -18,6 +18,14 @@ export const routes: Routes = [
         loadComponent: () =>
           import('@behandeling/ui/werkvoorraad.page').then((m) => m.WerkvoorraadPage),
       },
+      {
+        path: 'aanvraag/:id',
+        // Same capability the werkvoorraad list itself is gated by (WP-64/65) — the
+        // detail page is reachable only from a row already filtered to that capability.
+        canActivate: [capabilityGuard('aanvraag:beoordelen')],
+        loadComponent: () =>
+          import('@behandeling/ui/beoordeling.page').then((m) => m.BeoordelingPage),
+      },
       {
         path: 'beheer/stamdata',
         // Admin-only stamdata maintenance editor (ADR-0004): capabilityGuard denies-by-default