feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/RuleTests.cs

@@ -1,3 +1,5 @@
+using BigRegister.Api.Data;
+using BigRegister.Domain.Beoordeling;
 using BigRegister.Domain.Diplomas;
 using BigRegister.Domain.Documents;
 using BigRegister.Domain.Registrations;
@@ -179,3 +181,15 @@ public class SubmissionRuleTests
   public void Phone_change_is_validated(string telefoon, string? expected) =>
       Assert.Equal(expected, SubmissionRules.RejectPhoneChange(telefoon));
 }
+
+public class BeoordelingRuleTests
+{
+  [Theory]
+  [InlineData(AanvraagStatusTag.Ingediend, true)]
+  [InlineData(AanvraagStatusTag.InBehandeling, true)]
+  [InlineData(AanvraagStatusTag.MeerInfoGevraagd, true)]
+  [InlineData(AanvraagStatusTag.Goedgekeurd, false)]
+  [InlineData(AanvraagStatusTag.Afgewezen, false)]
+  public void Only_open_statuses_are_decidable(AanvraagStatusTag tag, bool expected) =>
+      Assert.Equal(expected, BeoordelingRules.CanDecide(tag));
+}