fix(backend): resolve besluit endpoint's id via Referentie, not local PK

POST /beoordeling/{id}/besluit always 404'd against a real OpenZaak: {id} is the
FE-facing case id from IZaakSource.ListCases, which under OpenZaakZaakSource is the
ZGW zaak's own uuid, not ApplicationStore's primary key. Resolve the case through
ListCases first (same seam the GET sibling already uses), then to the local Aanvraag
via its Referentie — the one identifier stable across both sources.

Adds ApplicationStore.GetByReferentie and a regression test that reproduces the
divergence with a decorating IZaakSource test double instead of a live OpenZaak.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/shared/src/infrastructure/me.adapter.spec.ts

@@ -18,6 +18,17 @@ describe('parseMe (trust boundary)', () => {
     });
   });
 
+  // Regression: WP-66's `aanvraag:beoordelen` (behandelportal) shipped on the `Capability`
+  // type but was never added to this trust-boundary's runtime KNOWN list, so a real
+  // behandelaar's `/me` response had the capability silently dropped and the werkvoorraad
+  // page always denied — every `Capability` union member belongs in KNOWN too.
+  it('recognizes the behandelportal besluit capability (WP-66)', () => {
+    expect(parseMe({ capabilities: ['aanvraag:beoordelen'] })).toEqual({
+      ok: true,
+      value: ['aanvraag:beoordelen'],
+    });
+  });
+
   it('drops unrecognized capability strings instead of rejecting the response', () => {
     const r = parseMe({ capabilities: ['brief:approve', 'unknown:future-thing'] });
     expect(r).toEqual({ ok: true, value: ['brief:approve'] });

libs/shared/src/infrastructure/me.adapter.ts

@@ -11,6 +11,7 @@ const KNOWN: readonly Capability[] = [
   'stamdata:edit',
   'cases:manage',
   'flags:manage',
+  'aanvraag:beoordelen',
 ];
 
 /**