feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/OpenZaakZaakSourceTests.cs

@@ -1,5 +1,6 @@
 using BigRegister.Api.Data;
 using BigRegister.Api.Zgw;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Tests;
 
@@ -58,6 +59,26 @@ public class OpenZaakZaakSourceTests
     Assert.All(handler.AuthSchemes, s => Assert.Equal("Bearer", s));
   }
 
+  [Fact]
+  public void ListMyCases_filters_by_the_callers_bsn()
+  {
+    var handler = new ZgwStubHandler(url => url switch
+    {
+      _ when url.StartsWith($"{ZrcBase}/zaken") => """{ "count": 0, "next": null, "results": [] }""",
+      _ => throw new InvalidOperationException($"unexpected ZGW GET {url}"),
+    });
+
+    var options = new ZgwOptions { ZrcBaseUrl = ZrcBase, ZtcBaseUrl = ZtBase, ClientId = "c", Secret = "s" };
+    var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+    var caller = new CallerIdentity("111222333", "Dr. Test", PrincipalRole.Drafter);
+
+    source.ListMyCases(caller, DateTimeOffset.UtcNow);
+
+    Assert.Single(handler.Requests, r =>
+        r.StartsWith($"{ZrcBase}/zaken?") &&
+        r.Contains("rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn=111222333"));
+  }
+
   [Fact]
   public void CreateZaak_posts_zaak_status_and_rol_and_maps_the_result_back()
   {
@@ -101,7 +122,8 @@ public class OpenZaakZaakSourceTests
       Referentie = "BIG-2026-000123",
     };
 
-    var (referentie, status, zaakUrl) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero));
+    var caller = new CallerIdentity(aanvraag.Owner, "Dr. Test", PrincipalRole.Drafter);
+    var (referentie, status, zaakUrl) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero), caller);
 
     Assert.Equal("BIG-2026-000123", referentie);
     Assert.Equal("InBehandeling", status.Tag);
@@ -133,7 +155,8 @@ public class OpenZaakZaakSourceTests
     var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
     var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
     var aanvraag = new Aanvraag { Id = "a1", Type = "unknown-type", Owner = "111222333", Referentie = "BIG-2026-000123" };
+    var caller = new CallerIdentity(aanvraag.Owner, "Dr. Test", PrincipalRole.Drafter);
 
-    Assert.Throws<InvalidOperationException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow));
+    Assert.Throws<InvalidOperationException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow, caller));
   }
 }