feat(openzaak): per-document-type confidentialiteit config (WP-59)

Drives the DRC upload's vertrouwelijkheidaanduiding from a new stamdata
table instead of the hardcoded "openbaar", following the existing
config-as-code pattern (ADR-0004). Adds the referential-integrity check
StamdataValidationTests was missing for the new table.

docs/project/backlog/WP-59-document-confidentialiteit-config.md

@@ -1,6 +1,6 @@
 # WP-59 — Per-document-type confidentialiteit config
 
-Status: todo
+Status: done
 Phase: 10 — OpenZaak production hardening
 
 ## Why
@@ -43,17 +43,35 @@ this slice is "apply the existing pattern," not invent a new one.
 
 ## Acceptance criteria
 
-- [ ] Confidentiality level for a real upload varies by document type per the new
-      stamdata table.
-- [ ] `StamdataValidationTests` cover the new table (a bad edit fails CI, per ADR-0004).
-- [ ] `/beheer/stamdata` can edit the new table without a code change (existing generic
-      editor).
+- [x] Confidentiality level for a real upload varies by document type per the new
+      stamdata table (`identiteit` → `vertrouwelijk`; everything else → `openbaar`).
+- [x] `StamdataValidationTests` cover the new table (a bad edit fails CI, per ADR-0004).
+- [x] `/beheer/stamdata` can edit the new table without a code change (existing generic
+      editor — the `StamdataCatalog` registration is the only wiring needed).
+
+## What actually happened
+
+Implemented mostly as planned — one gap found and closed: the diff as first written
+registered `DocumentConfidentialiteit` in `StamdataCatalog` and wired the lookup into
+`OpenZaakDocumentSource`, plus a positive test (`identiteit` → `vertrouwelijk`) and a
+fallback test (an unmapped category, `org-logo`, → `openbaar`), but had **no**
+`StamdataValidationTests` reference-integrity entry for the new table — the second
+acceptance box was unchecked. Added one: a `StamdataRef` resolving every
+`documentconfidentialiteit.json` `categoryId` against the real set of document category
+ids (`DocumentRules.AllCategoriesFor` across `registratie`/`herregistratie`/`org-template`),
+so a typo'd or stale `categoryId` now fails the build instead of silently never matching
+(`OpenZaakDocumentSource.ConfidentialiteitFor`'s dictionary lookup would otherwise just
+fall back to `"openbaar"` forever with no signal). `org-logo` deliberately stays absent
+from the confidentialiteit table (falls back to `"openbaar"`) and correctly still
+resolves as a known category — the reference check validates "is this a real category",
+not "must every category be configured."
 
 ## Verification
 
-`cd backend && dotnet test`; manual: `/beheer/stamdata` shows and edits the new table; an
-upload for a mapped document type carries the mapped confidentiality level (test
-asserted).
+`cd backend && dotnet test` (161/161 green, incl. the 2 new `OpenZaakDocumentSourceTests`
++ the new `StamdataValidationTests` reference entry); `dotnet format --verify-no-changes`
+clean. Manual: `/beheer/stamdata` shows and edits the new table; an upload for a mapped
+document type carries the mapped confidentiality level (test asserted).
 
 ## Out of scope