feat(audit): record the allow path, not just the denial (RB-07)

All five authorization gates audited only their deny branch, so /beheer/audit
could answer "who was turned away" but never "who changed this" — for a
register whose integrity is the product, the wrong half. Nothing recorded the
flag toggle, either org-template write, the admin case or upload delete, the
three brief transitions, or the besluit; the comment claiming endpoints log
their own effect held for two of the eight.

Each gate now computes the decision once, audits it, and then acts. The row
is written by the gate rather than the endpoint, so a new admin endpoint
cannot be added that forgets to audit itself. Same reasoning for the brief:
every transition already funnelled through LogBrief for its log line, so the
audit row goes there too — submit/approve/reject/send in one place, with the
transition's own outcome as the decision, so a 403 or 409 is as visible as a
success.

FlagsAdmin gained a per-call resource, the one deviation from BIO-007's
minimal remediation: the toggle endpoint writes no log line of its own, so a
constant "feature-flags" row would say a flag changed without saying which.
It now records feature-flags/<key>=<value>. OrgAdmin and CasesAdmin keep
coarse refs because those endpoints do log the specific object.

The besluit gets a second row: the gate records that a behandelaar was
allowed to act, aanvraag:besluit records what they decided.

Row volume goes up — StamdataAdmin gates read endpoints, so admin page loads
now write rows. That is what auditing the allow path means; it is also what
would make retention on AuthzAuditStore necessary later.

Closes CQ-004's outstanding half and unblocks signing ADR-C-009.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/AuthzAuditTests.cs

@@ -3,6 +3,7 @@ using System.Net.Http.Json;
 using System.Text.RegularExpressions;
 using BigRegister.Api.Contracts;
 using BigRegister.Api.Data;
+using BigRegister.Domain.Features;
 using Microsoft.AspNetCore.Mvc.Testing;
 
 namespace BigRegister.Tests;
@@ -43,6 +44,43 @@ public class AuthzAuditTests(TestWebApplicationFactory factory) : IClassFixture<
     Assert.Contains(await AuditLog(), e => e.Action == "brief:reveal-bignummer");
   }
 
+  /// RB-07/BIO-007: the trail used to record only denials, so `/beheer/audit` could answer
+  /// "who was turned away" but not "who changed this" — for a register whose integrity is the
+  /// product, the wrong half. Every gate now audits the real decision.
+  [Fact]
+  public async Task An_allowed_admin_action_is_recorded()
+  {
+    (await _client.SendAsync(Admin(HttpMethod.Get, "/api/v1/admin/cases"))).EnsureSuccessStatusCode();
+    Assert.Contains(await AuditLog(), e => e.Action == "cases:manage" && e.Decision == "allow" && e.Role == "Admin");
+  }
+
+  /// The flag toggle writes no log line of its own, so the audit row is the only record that
+  /// it happened — a bare "feature-flags" resource would not say which flag.
+  [Fact]
+  public async Task A_feature_flag_toggle_records_which_flag_changed()
+  {
+    var toggle = Admin(HttpMethod.Put, $"/api/v1/admin/flags/{FeatureFlags.InschrijvingOpen}");
+    toggle.Content = JsonContent.Create(new { enabled = false });
+    (await _client.SendAsync(toggle)).EnsureSuccessStatusCode();
+
+    Assert.Contains(await AuditLog(), e =>
+        e.Action == "flags:manage" && e.Decision == "allow" &&
+        e.Resource == $"feature-flags/{FeatureFlags.InschrijvingOpen}=False");
+  }
+
+  /// Every brief transition funnels through LogBrief, so all four are covered by the audit
+  /// call living there. The allow side is asserted in
+  /// <c>BriefEndpointTests.Submit_succeeds_when_required_sections_filled</c>, which already has
+  /// the fill-the-sections scaffolding; this is the refused side — a rejected transition must
+  /// leave a row rather than being dropped.
+  [Fact]
+  public async Task A_refused_brief_transition_is_recorded()
+  {
+    // No brief exists for this subject and nothing is filled in → illegal transition.
+    Assert.Equal(HttpStatusCode.Conflict, (await _client.PostAsync("/api/v1/brief/submit", null)).StatusCode);
+    Assert.Contains(await AuditLog(), e => e.Action == "brief:submit" && e.Decision == "deny");
+  }
+
   /// RB-02/BIO-008: the schema test below asserts on **column names**, so a BSN inside a
   /// column called `Resource` was invisible to it — and one was there, concatenated as
   /// `"brief/" + Bsn`. This asserts on the stored **values** instead. Four documents