feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -126,6 +126,20 @@ public sealed record SubmitApplicationRequest(
 
 public sealed record SubmitApplicationResponse(string Referentie, AanvraagStatusDto Status);
 
+// --- Beoordeling (WP-65): the behandelportal's case-detail screen. ---
+
+public sealed record BeoordelingDocumentDto(string DocumentId, string CategoryId, string FileName);
+
+/// Decision flag (ADR-0001): the FE renders "may I decide", it never recomputes the
+/// lifecycle. One flag today because all three decision actions share one rule
+/// (BeoordelingRules.CanDecide); split into per-action flags if that ever diverges.
+public sealed record BeoordelingDecisionsDto(bool CanBesluiten);
+
+public sealed record BeoordelingViewDto(
+    ApplicationSummaryDto Aanvraag,
+    IReadOnlyList<BeoordelingDocumentDto> Documenten,
+    BeoordelingDecisionsDto Decisions);
+
 // --- Brief (letter composition) contracts ---
 // Rich text is a serialisable node tree; the node union is flattened with a `Type`
 // discriminator + nullable fields, the same wire convention as AanvraagStatusDto.