feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/IDocumentSource.cs

@@ -1,4 +1,5 @@
 using BigRegister.Api.Contracts;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Api.Data;
 
@@ -14,15 +15,18 @@ namespace BigRegister.Api.Data;
 public interface IDocumentSource
 {
   /// <summary>Store an uploaded file (already validated by <c>DocumentRules</c>) and return the
-  /// existing <see cref="UploadResponse"/> DTO unchanged, whichever source is active.</summary>
+  /// existing <see cref="UploadResponse"/> DTO unchanged, whichever source is active.
+  /// <paramref name="caller"/> (WP-53) is both the document's owner (<c>DocumentStore</c>'s
+  /// ownership field) and, under the OpenZaak source, the identity minted into the ZGW JWT.</summary>
   UploadResponse Upload(
       string localId, string categoryId, string wizardId, string fileName, string contentType,
-      byte[] content, string owner);
+      byte[] content, CallerIdentity caller);
 
   /// <summary>Finalise a set of already-uploaded documents against a just-submitted aanvraag
   /// (WP-50/51): local behaviour is exactly today's <c>DocumentStore.Link</c>; the OpenZaak
   /// source additionally links each document (that has a DRC url) to the zaak, once
   /// <paramref name="zaakUrl"/> is known (null under the local <see cref="IZaakSource"/>, in
-  /// which case there is nothing extra to link).</summary>
-  void LinkToZaak(IReadOnlyList<string> documentIds, string? zaakUrl);
+  /// which case there is nothing extra to link) — minted with <paramref name="caller"/>'s
+  /// identity (WP-53).</summary>
+  void LinkToZaak(IReadOnlyList<string> documentIds, string? zaakUrl, CallerIdentity caller);
 }

backend/src/BigRegister.Api/Data/IZaakSource.cs

@@ -1,4 +1,5 @@
 using BigRegister.Api.Contracts;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Api.Data;
 
@@ -16,9 +17,19 @@ namespace BigRegister.Api.Data;
 /// </summary>
 public interface IZaakSource
 {
-  /// <summary>Every case, newest-first (the admin cross-owner list, WP-36).</summary>
+  /// <summary>Every case across every owner, newest-first (the admin cross-owner list,
+  /// WP-36) — cases:manage only, deliberately NOT citizen-scoped.</summary>
   IReadOnlyList<ApplicationSummaryDto> ListCases(DateTimeOffset now);
 
+  /// <summary>
+  /// Only <paramref name="caller"/>'s own cases (WP-53) — the citizen-scoped counterpart of
+  /// <see cref="ListCases"/>, backing the citizen's own dashboard. The local source filters
+  /// <c>ApplicationStore</c> by owner (unchanged behaviour); the OpenZaak source adds ZGW's
+  /// <c>rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn</c> query filter so a citizen
+  /// can never see another citizen's zaken.
+  /// </summary>
+  IReadOnlyList<ApplicationSummaryDto> ListMyCases(CallerIdentity caller, DateTimeOffset now);
+
   /// <summary>
   /// Register a just-submitted <paramref name="aanvraag"/> as a zaak (WP-50). The aanvraag is
   /// already persisted locally (<c>ApplicationStore.Submit</c> already ran) — this is the
@@ -28,7 +39,8 @@ public interface IZaakSource
   /// reference/status (ZaakUrl null — nothing to persist); the OpenZaak source creates a Zaak
   /// (+ status + rol) and maps the result back into the same shape, returning the zaak's URL
   /// so the endpoint can persist it (<see cref="ApplicationStore.SetZaakUrl"/>, WP-51 needs it
-  /// to later link documents to this zaak).
+  /// to later link documents to this zaak). <paramref name="caller"/> (WP-53) is the acting
+  /// citizen — the ZGW JWT's audit claims reflect them, not a static config identity.
   /// </summary>
-  (string Referentie, AanvraagStatusDto Status, string? ZaakUrl) CreateZaak(Aanvraag aanvraag, DateTimeOffset now);
+  (string Referentie, AanvraagStatusDto Status, string? ZaakUrl) CreateZaak(Aanvraag aanvraag, DateTimeOffset now, CallerIdentity caller);
 }

backend/src/BigRegister.Api/Data/LocalDocumentSource.cs

@@ -1,4 +1,5 @@
 using BigRegister.Api.Contracts;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Api.Data;
 
@@ -12,12 +13,12 @@ public sealed class LocalDocumentSource : IDocumentSource
 {
   public UploadResponse Upload(
       string localId, string categoryId, string wizardId, string fileName, string contentType,
-      byte[] content, string owner)
+      byte[] content, CallerIdentity caller)
   {
-    var doc = DocumentStore.Add(localId, categoryId, wizardId, fileName, contentType, content, owner);
+    var doc = DocumentStore.Add(localId, categoryId, wizardId, fileName, contentType, content, caller.Bsn);
     return new UploadResponse(doc.DocumentId, doc.LocalId);
   }
 
-  public void LinkToZaak(IReadOnlyList<string> documentIds, string? zaakUrl) =>
+  public void LinkToZaak(IReadOnlyList<string> documentIds, string? zaakUrl, CallerIdentity caller) =>
       DocumentStore.Link(documentIds);
 }

backend/src/BigRegister.Api/Data/LocalZaakSource.cs

@@ -1,4 +1,5 @@
 using BigRegister.Api.Contracts;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Api.Data;
 
@@ -13,8 +14,15 @@ public sealed class LocalZaakSource : IZaakSource
   public IReadOnlyList<ApplicationSummaryDto> ListCases(DateTimeOffset now) =>
       ApplicationStore.ListAll().Select(a => a.ToAdminSummaryDto(now)).ToList();
 
+  /// <summary>Citizen-scoped (WP-53) — exactly what <c>GET /applications</c> used to compute
+  /// inline before it was routed through this seam.</summary>
+  public IReadOnlyList<ApplicationSummaryDto> ListMyCases(CallerIdentity caller, DateTimeOffset now) =>
+      ApplicationStore.List(caller.Bsn)
+          .OrderByDescending(a => a.UpdatedAt)
+          .Select(a => a.ToSummaryDto(now)).ToList();
+
   /// <summary>No external zaak to create — the aanvraag's local submit already IS the record
   /// of truth, exactly as before this seam existed (WP-50). Zero behaviour change.</summary>
-  public (string Referentie, AanvraagStatusDto Status, string? ZaakUrl) CreateZaak(Aanvraag aanvraag, DateTimeOffset now) =>
+  public (string Referentie, AanvraagStatusDto Status, string? ZaakUrl) CreateZaak(Aanvraag aanvraag, DateTimeOffset now, CallerIdentity caller) =>
       (aanvraag.Referentie!, aanvraag.ToStatusDto(now), null);
 }