feat(openzaak): per-document-type confidentialiteit config (WP-59)

Drives the DRC upload's vertrouwelijkheidaanduiding from a new stamdata
table instead of the hardcoded "openbaar", following the existing
config-as-code pattern (ADR-0004). Adds the referential-integrity check
StamdataValidationTests was missing for the new table.

backend/tests/BigRegister.Tests/OpenZaakDocumentSourceTests.cs

@@ -58,6 +58,23 @@ public class OpenZaakDocumentSourceTests
     Assert.Contains("123443210", body);       // bronorganisatie
     Assert.Contains("paspoort.pdf", body);
     Assert.Contains(Convert.ToBase64String("%PDF-1.4 fake"u8.ToArray()), body); // inhoud
+    // WP-59: "identiteit" is mapped to "vertrouwelijk" in the confidentialiteit stamdata.
+    Assert.Contains("\"vertrouwelijkheidaanduiding\":\"vertrouwelijk\"", body);
+  }
+
+  [Fact]
+  public void Upload_falls_back_to_openbaar_for_a_category_absent_from_the_confidentialiteit_table()
+  {
+    var options = Options();
+    options.InformatieobjecttypeUrls["org-logo"] = InformatieobjecttypeUrl;
+    var handler = new ZgwStubHandler(url =>
+        """{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-2" }""");
+    var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    source.Upload("local-2", "org-logo", "org-template", "logo.png", "image/png", [1, 2, 3], Caller);
+
+    var body = handler.BodyOf($"{DrcBase}/enkelvoudiginformatieobjecten");
+    Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", body);
   }
 
   [Fact]