feat(openzaak): per-document-type confidentialiteit config (WP-59)

Drives the DRC upload's vertrouwelijkheidaanduiding from a new stamdata
table instead of the hardcoded "openbaar", following the existing
config-as-code pattern (ADR-0004). Adds the referential-integrity check
StamdataValidationTests was missing for the new table.

backend/tests/BigRegister.Tests/StamdataValidationTests.cs

@@ -1,5 +1,6 @@
 using BigRegister.Api.Data;
 using BigRegister.Domain.Diplomas;
+using BigRegister.Domain.Documents;
 using BigRegister.Stamdata;
 
 namespace BigRegister.Tests;
@@ -22,6 +23,14 @@ public class StamdataValidationTests
   private static readonly IReadOnlySet<string> BeroepCodes =
       StamdataFile.Load<Beroep>("beroepen").Select(b => b.Code).ToHashSet(StringComparer.Ordinal);
 
+  // Every document category id that exists across any wizard (WP-59's confidentialiteit
+  // table points at these) — "org-logo" resolves too, even though it's deliberately absent
+  // from the confidentialiteit table itself (falls back to "openbaar").
+  private static readonly IReadOnlySet<string> DocumentCategoryIds = new[] { "registratie", "herregistratie", "org-template" }
+      .SelectMany(DocumentRules.AllCategoriesFor)
+      .Select(c => c.CategoryId)
+      .ToHashSet(StringComparer.Ordinal);
+
   private static readonly IReadOnlyList<StamdataRef> References = new[]
   {
     new StamdataRef(
@@ -38,6 +47,12 @@ public class StamdataValidationTests
         "Specialisme.beroep → beroepen.code",
         StamdataFile.Load<Specialisme>("specialismen").Select(s => s.Beroep),
         key => BeroepCodes.Contains(key)),
+    // WP-59: a confidentialiteit row for a category that no wizard ever asks for is dead
+    // config — fail the build rather than let it silently rot.
+    new StamdataRef(
+        "DocumentConfidentialiteit.CategoryId → a real document category",
+        StamdataFile.Load<DocumentConfidentialiteit>("documentconfidentialiteit").Select(d => d.CategoryId),
+        key => DocumentCategoryIds.Contains(key)),
   };
 
   [Fact]