feat(openzaak): per-document-type confidentialiteit config (WP-59)

Drives the DRC upload's vertrouwelijkheidaanduiding from a new stamdata
table instead of the hardcoded "openbaar", following the existing
config-as-code pattern (ADR-0004). Adds the referential-integrity check
StamdataValidationTests was missing for the new table.

docs/project/backlog/README.md

@@ -109,7 +109,7 @@ for its existing violations, so every WP ends green.
 | [WP-56](WP-56-openzaak-catalogus-provisioning.md)      | Idempotent catalogus provisioning                                                  | 10 · OpenZaak hardening     | done   |
 | [WP-57](WP-57-openzaak-least-privilege-scopes.md)      | Least-privilege client scopes                                                      | 10 · OpenZaak hardening     | done   |
 | [WP-58](WP-58-openzaak-notifications.md)               | Real notifications (celery + scripted abonnement)                                  | 10 · OpenZaak hardening     | done   |
-| [WP-59](WP-59-document-confidentialiteit-config.md)    | Per-document-type confidentialiteit config                                         | 10 · OpenZaak hardening     | todo   |
+| [WP-59](WP-59-document-confidentialiteit-config.md)    | Per-document-type confidentialiteit config                                         | 10 · OpenZaak hardening     | done   |
 | [WP-60](WP-60-write-divergence-resilience.md)          | Write-divergence resilience (local + ZGW writes)                                   | 10 · OpenZaak hardening     | todo   |
 | [WP-61](WP-61-behandelportal-bootstrap.md)             | Bootstrap the behandelportal app                                                   | 11 · Behandelportal         | todo   |
 | [WP-62](WP-62-medewerker-identity-authz.md)            | Backend: medewerker caller identity + authz seam                                   | 11 · Behandelportal         | todo   |

docs/project/backlog/WP-59-document-confidentialiteit-config.md

@@ -1,6 +1,6 @@
 # WP-59 — Per-document-type confidentialiteit config
 
-Status: todo
+Status: done
 Phase: 10 — OpenZaak production hardening
 
 ## Why
@@ -43,17 +43,35 @@ this slice is "apply the existing pattern," not invent a new one.
 
 ## Acceptance criteria
 
-- [ ] Confidentiality level for a real upload varies by document type per the new
-      stamdata table.
-- [ ] `StamdataValidationTests` cover the new table (a bad edit fails CI, per ADR-0004).
-- [ ] `/beheer/stamdata` can edit the new table without a code change (existing generic
-      editor).
+- [x] Confidentiality level for a real upload varies by document type per the new
+      stamdata table (`identiteit` → `vertrouwelijk`; everything else → `openbaar`).
+- [x] `StamdataValidationTests` cover the new table (a bad edit fails CI, per ADR-0004).
+- [x] `/beheer/stamdata` can edit the new table without a code change (existing generic
+      editor — the `StamdataCatalog` registration is the only wiring needed).
+
+## What actually happened
+
+Implemented mostly as planned — one gap found and closed: the diff as first written
+registered `DocumentConfidentialiteit` in `StamdataCatalog` and wired the lookup into
+`OpenZaakDocumentSource`, plus a positive test (`identiteit` → `vertrouwelijk`) and a
+fallback test (an unmapped category, `org-logo`, → `openbaar`), but had **no**
+`StamdataValidationTests` reference-integrity entry for the new table — the second
+acceptance box was unchecked. Added one: a `StamdataRef` resolving every
+`documentconfidentialiteit.json` `categoryId` against the real set of document category
+ids (`DocumentRules.AllCategoriesFor` across `registratie`/`herregistratie`/`org-template`),
+so a typo'd or stale `categoryId` now fails the build instead of silently never matching
+(`OpenZaakDocumentSource.ConfidentialiteitFor`'s dictionary lookup would otherwise just
+fall back to `"openbaar"` forever with no signal). `org-logo` deliberately stays absent
+from the confidentialiteit table (falls back to `"openbaar"`) and correctly still
+resolves as a known category — the reference check validates "is this a real category",
+not "must every category be configured."
 
 ## Verification
 
-`cd backend && dotnet test`; manual: `/beheer/stamdata` shows and edits the new table; an
-upload for a mapped document type carries the mapped confidentiality level (test
-asserted).
+`cd backend && dotnet test` (161/161 green, incl. the 2 new `OpenZaakDocumentSourceTests`
++ the new `StamdataValidationTests` reference entry); `dotnet format --verify-no-changes`
+clean. Manual: `/beheer/stamdata` shows and edits the new table; an upload for a mapped
+document type carries the mapped confidentiality level (test asserted).
 
 ## Out of scope