feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -83,6 +83,19 @@ public static class DocumentStore
     }
   }
 
+  /// <summary>Documents by DocumentId (WP-65's beoordeling detail reads an aanvraag's already-
+  /// linked documents) — the DocumentId-keyed counterpart of <see cref="ByLocalIds"/>, which is
+  /// keyed by the wizard's own LocalId instead.</summary>
+  public static IReadOnlyList<StoredDocument> ByIds(IEnumerable<string> documentIds)
+  {
+    var set = documentIds.ToHashSet();
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      return db.Documents.Where(d => set.Contains(d.DocumentId)).ToList();
+    }
+  }
+
   /// <summary>Persist the DRC url an OpenZaak upload (WP-51) registered for a document.</summary>
   public static void SetDrcUrl(string documentId, string drcUrl)
   {