feat(zgw): OpenZaak Documenten (DRC) upload + zaak link (WP-51)

Extends the OpenZaak seam with IDocumentSource, sibling of IZaakSource
(WP-49/50): an upload always lands locally first (DocumentStore stays
the record of truth for preview/download/audit) and, when
Zgw:Enabled=true, is also registered as a DRC enkelvoudiginformatie-
object; once a zaak exists (IZaakSource.CreateZaak now also returns
its ZaakUrl), submit links each document to it via zaakinformatie-
object. FE upload/list DTOs are unchanged.

- ZgwOptions gains DrcBaseUrl + a category->informatieobjecttype URL
  map (the document analogue of ZaaktypeUrls).
- LocalDocumentSource is the same DocumentStore.Add/Link calls the
  endpoints used to make inline — zero behaviour change offline.
- OpenZaakDocumentSource POSTs the eio then the zaak link, persisting
  the DRC url (DocumentStore.SetDrcUrl) so linking doesn't re-upload.
- Factored the GET/POST-with-bearer-JWT plumbing shared with
  OpenZaakZaakSource into ZgwHttpClient; shared the stub handler
  between the two source test classes as ZgwStubHandler.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -51,10 +51,13 @@ if (zgw.Enabled)
   builder.Services.AddSingleton(zgw);
   builder.Services.AddSingleton<ZgwTokenProvider>();
   builder.Services.AddHttpClient<IZaakSource, OpenZaakZaakSource>();
+  // WP-51: the documents (Documenten API / DRC) seam — same pattern as IZaakSource above.
+  builder.Services.AddHttpClient<IDocumentSource, OpenZaakDocumentSource>();
 }
 else
 {
   builder.Services.AddSingleton<IZaakSource, LocalZaakSource>();
+  builder.Services.AddSingleton<IDocumentSource, LocalDocumentSource>();
 }
 
 var app = builder.Build();
@@ -177,7 +180,7 @@ api.MapGet("/uploads/categories", (string wizardId, string? diplomaHerkomst, str
 // Multipart upload. Hand-written on the FE (XHR for progress), so it is excluded
 // from the OpenAPI doc to keep the NSwag-generated client JSON-only. Validates type
 // and size authoritatively; stores metadata only (no file bytes / PII held).
-api.MapPost("/uploads", async (HttpRequest request) =>
+api.MapPost("/uploads", async (HttpRequest request, IDocumentSource documents) =>
 {
   if (!request.HasFormContentType) return Results.Problem(detail: "Verwacht multipart/form-data.", statusCode: 400);
   var form = await request.ReadFormAsync();
@@ -192,8 +195,11 @@ api.MapPost("/uploads", async (HttpRequest request) =>
 
   using var ms = new MemoryStream();
   await file.CopyToAsync(ms);
-  var doc = DocumentStore.Add(localId, categoryId, wizardId, file.FileName, file.ContentType, ms.ToArray(), DocumentStore.DemoOwner);
-  return Results.Created($"/api/v1/uploads/{doc.DocumentId}", new UploadResponse(doc.DocumentId, localId));
+  // WP-51: route through IDocumentSource — LocalDocumentSource is the same DocumentStore.Add
+  // call this used to make inline; OpenZaakDocumentSource (Zgw:Enabled=true) also registers
+  // the file as a DRC enkelvoudiginformatieobject. Response DTO unchanged either way.
+  var response = documents.Upload(localId, categoryId, wizardId, file.FileName, file.ContentType, ms.ToArray(), DocumentStore.DemoOwner);
+  return Results.Created($"/api/v1/uploads/{response.DocumentId}", response);
 })
 .ExcludeFromDescription();
 
@@ -299,7 +305,7 @@ api.MapDelete("/applications/{id}", (string id) =>
 
 // Submit runs the server-owned rules, sets autoApprovable, and transitions the
 // aanvraag. handmatig no longer 422s (ADR-0002): it becomes a manual (pending) case.
-api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest req, HttpContext ctx, IZaakSource zaken) =>
+api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest req, HttpContext ctx, IZaakSource zaken, IDocumentSource documents) =>
 {
   var existing = ApplicationStore.Get(id, DocumentStore.DemoOwner);
   if (existing is null) return Results.NotFound();
@@ -314,9 +320,7 @@ api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest re
   };
 
   var docs = req.Documents;
-  if (docs is not null)
-    DocumentStore.Link(docs.Where(d => d.Channel == "digital" && d.DocumentId is not null).Select(d => d.DocumentId!));
-  var documentIds = docs?.Where(d => d.DocumentId is not null).Select(d => d.DocumentId!).ToList();
+  var documentIds = docs?.Where(d => d.Channel == "digital" && d.DocumentId is not null).Select(d => d.DocumentId!).ToList();
 
   var submitted = ApplicationStore.Submit(id, DocumentStore.DemoOwner, reject, autoApprovable, documentIds);
   if (submitted is null) return Results.Conflict();
@@ -329,7 +333,14 @@ api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest re
   // of what was computed above; OpenZaakZaakSource (Zgw:Enabled=true) also registers a zaak
   // in OpenZaak and maps its result back into this same response shape (ADR-0001/ADR-0005:
   // zero FE contract change either way).
-  var (referentie, status) = zaken.CreateZaak(submitted, DateTimeOffset.UtcNow);
+  var (referentie, status, zaakUrl) = zaken.CreateZaak(submitted, DateTimeOffset.UtcNow);
+  if (zaakUrl is not null) ApplicationStore.SetZaakUrl(id, zaakUrl);
+
+  // WP-51: link the submitted documents to the zaak — LocalDocumentSource is exactly the
+  // DocumentStore.Link call this used to make inline; OpenZaakDocumentSource additionally
+  // POSTs a zaakinformatieobject per document, now that the zaak (zaakUrl) exists.
+  if (documentIds is not null) documents.LinkToZaak(documentIds, zaakUrl);
+
   return Results.Ok(new SubmitApplicationResponse(referentie, status));
 })
 .Produces<SubmitApplicationResponse>()