feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/OpenZaakDocumentSourceTests.cs

@@ -1,5 +1,6 @@
 using BigRegister.Api.Data;
 using BigRegister.Api.Zgw;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Tests;
 
@@ -26,6 +27,8 @@ public class OpenZaakDocumentSourceTests
     InformatieobjecttypeUrls = new() { ["identiteit"] = InformatieobjecttypeUrl },
   };
 
+  private static readonly CallerIdentity Caller = new("111222333", "Dr. Test", PrincipalRole.Drafter);
+
   [Fact]
   public void Upload_registers_an_eio_in_drc_and_persists_its_url_locally()
   {
@@ -39,7 +42,7 @@ public class OpenZaakDocumentSourceTests
     var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
 
     var response = source.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf",
-        "%PDF-1.4 fake"u8.ToArray(), "111222333");
+        "%PDF-1.4 fake"u8.ToArray(), Caller);
 
     Assert.Equal("local-1", response.LocalId);
     Assert.NotEmpty(response.DocumentId);
@@ -65,7 +68,7 @@ public class OpenZaakDocumentSourceTests
     var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
 
     Assert.Throws<InvalidOperationException>(() =>
-        source.Upload("local-1", "unknown-category", "registratie", "f.pdf", "application/pdf", [1, 2, 3], "111222333"));
+        source.Upload("local-1", "unknown-category", "registratie", "f.pdf", "application/pdf", [1, 2, 3], Caller));
   }
 
   [Fact]
@@ -75,7 +78,7 @@ public class OpenZaakDocumentSourceTests
     var uploadHandler = new ZgwStubHandler(url =>
         """{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1" }""");
     var uploader = new OpenZaakDocumentSource(new HttpClient(uploadHandler), new ZgwTokenProvider(options), options);
-    var doc = uploader.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf", [1, 2, 3], "111222333");
+    var doc = uploader.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf", [1, 2, 3], Caller);
 
     var linkHandler = new ZgwStubHandler(url => url switch
     {
@@ -84,14 +87,14 @@ public class OpenZaakDocumentSourceTests
     });
     var linker = new OpenZaakDocumentSource(new HttpClient(linkHandler), new ZgwTokenProvider(options), options);
 
-    linker.LinkToZaak([doc.DocumentId], $"{ZrcBase}/zaken/uuid-1");
+    linker.LinkToZaak([doc.DocumentId], $"{ZrcBase}/zaken/uuid-1", Caller);
 
     var body = linkHandler.BodyOf($"{ZrcBase}/zaakinformatieobjecten");
     Assert.Contains($"{ZrcBase}/zaken/uuid-1", body);
     Assert.Contains("eio-1", body);
 
     // Local link also happened (dual-write) — the document is now Linked (delete blocked).
-    Assert.Equal(DocumentStore.DeleteResult.Linked, DocumentStore.DeleteOwned(doc.DocumentId, "111222333"));
+    Assert.Equal(DocumentStore.DeleteResult.Linked, DocumentStore.DeleteOwned(doc.DocumentId, Caller.Bsn));
   }
 
   [Fact]
@@ -101,7 +104,7 @@ public class OpenZaakDocumentSourceTests
     var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
     var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
 
-    source.LinkToZaak(["some-document-id"], zaakUrl: null);
+    source.LinkToZaak(["some-document-id"], zaakUrl: null, Caller);
 
     Assert.Empty(handler.Requests);
   }