fix(backend): resolve besluit endpoint's id via Referentie, not local PK

POST /beoordeling/{id}/besluit always 404'd against a real OpenZaak: {id} is the
FE-facing case id from IZaakSource.ListCases, which under OpenZaakZaakSource is the
ZGW zaak's own uuid, not ApplicationStore's primary key. Resolve the case through
ListCases first (same seam the GET sibling already uses), then to the local Aanvraag
via its Referentie — the one identifier stable across both sources.

Adds ApplicationStore.GetByReferentie and a regression test that reproduces the
divergence with a decorating IZaakSource test double instead of a live OpenZaak.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/openzaak/README.md

@@ -50,7 +50,7 @@ dotnet test --filter Category=Integration
 `OpenZaakIntegrationTests.cs` points a `WebApplicationFactory<Program>` at
 `Zgw:Enabled=true` + `http://localhost:8000` with the harness's credentials, hits
 `GET /api/v1/admin/cases`, and asserts the seeded zaak comes back — through the real HTTP +
-JWT + Catalogi-label-resolution path, not a mock. This test is tagged `Category=Integration`
+JWT + zaaktype→aanvraag-type mapping path, not a mock. This test is tagged `Category=Integration`
 and is **excluded** from the default `dotnet test` run and from CI (`ci.yml`,
 `scripts/ci-local.sh` both filter `Category!=Integration`) — it only passes with this harness
 up, so it never runs where the harness doesn't exist.