feat(registratie): WP-35 — one Concept per case type (server-enforced)

Make "at most one unsubmitted Concept per type" a server invariant instead of a
client-only convenience. ApplicationStore.Create → CreateConcept guards atomically
under the write gate and POST /applications returns 409 when a duplicate would be
created. The FE draft-sync recovers from the 409 by adopting the existing Concept
(ensureId → findConcept) rather than erroring — one-per-type means the second
attempt lands on the existing draft. Typed client regenerated (documents the 409).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/ApplicationStore.cs

@@ -41,17 +41,24 @@ public static class ApplicationStore
 
   private static readonly object _gate = new();
 
-  public static Aanvraag Create(string type, string owner)
+  /// Create a Concept for <paramref name="owner"/> — UNLESS one of this
+  /// <paramref name="type"/> already exists unsubmitted. WP-35: at most one Concept per
+  /// type is a server-enforced invariant (the FE's draft-sync only guards it best-effort).
+  /// Race-free: the existence check and the insert share the single write gate. Returns
+  /// null when a duplicate would be created (the caller maps that to 409 Conflict).
+  public static Aanvraag? CreateConcept(string type, string owner)
   {
     var now = DateTimeOffset.UtcNow;
-    var a = new Aanvraag { Id = Guid.NewGuid().ToString(), Type = type, Owner = owner, CreatedAt = now, UpdatedAt = now };
     lock (_gate)
     {
       using var db = Db.Create();
+      if (db.Applications.Any(a => a.Owner == owner && a.Type == type && !a.Submitted))
+        return null;
+      var a = new Aanvraag { Id = Guid.NewGuid().ToString(), Type = type, Owner = owner, CreatedAt = now, UpdatedAt = now };
       db.Applications.Add(a);
       db.SaveChanges();
+      return a;
     }
-    return a;
   }
 
   public static Aanvraag? Get(string id, string owner)

backend/src/BigRegister.Api/Program.cs

@@ -244,10 +244,15 @@ api.MapGet("/applications/{id}", (string id) =>
 
 api.MapPost("/applications", (CreateApplicationRequest req) =>
 {
-  var a = ApplicationStore.Create(req.Type, DocumentStore.DemoOwner);
+  var a = ApplicationStore.CreateConcept(req.Type, DocumentStore.DemoOwner);
+  if (a is null)
+    return Results.Problem(
+        detail: "U hebt al een concept van dit type. Rond dat eerst af of verwijder het.",
+        statusCode: StatusCodes.Status409Conflict);
   return Results.Created($"/api/v1/applications/{a.Id}", a.ToDetailDto(DateTimeOffset.UtcNow));
 })
-.Produces<ApplicationDetailDto>(StatusCodes.Status201Created);
+.Produces<ApplicationDetailDto>(StatusCodes.Status201Created)
+.ProducesProblem(StatusCodes.Status409Conflict);
 
 // Draft sync per step — idempotent; keep it debounced on the client (it is chatty).
 api.MapPut("/applications/{id}", (string id, DraftSyncRequest req) =>