feat(portal-beheer): ACL default-fill configuration editor (closes #131) (#138)

## What & why

S-15b, second of the S-15 (#16) split, on top of S-15a (#133). A beheerder edits the ACL's ZGW **default-fill** values from the beheer portal, and the next zaak is stamped with the new values — no restart.

Closes #131

### The vertical

portal → BFF `GET/PUT /beheer/default-fill` (medewerker realm + `beheerder` role) → ACL `GET/PUT /default-fill` → a runtime-mutable in-memory store the ACL reads **per zaak**.

- **ACL**: `IDefaultFillStore` / `InMemoryDefaultFillStore` (thread-safe, seeded from `Acl:Defaults`); `AclService` reads `fill.Current` per zaak (not cached at construction); `GET`/`PUT /default-fill` with required-field validation.
- **BFF**: `IAclClient` gains `GetDefaultFillAsync`/`UpdateDefaultFillAsync`; `GET`/`PUT /beheer/default-fill` behind the `beheerder` policy. OpenAPI + generated client regenerated.
- **Frontend**: a *Default-fill* editor page in the beheer app (load → edit → save, with saved/failure states) + nav between Catalogus and Default-fill.

### Scope decision → ADR-0026

Only the **three ZGW fill fields** (bronorganisatie, verantwoordelijke organisatie, vertrouwelijkheidaanduiding) are editable. The S-27 catalog-resolution keys stay **static config** — editing them would desync the zaaktype-URL cache (ADR-0021), and they're catalogus wiring, not "default fill". The store is **in-memory** (seeded from config): an edit reverts on restart. That's the reference-app-appropriate ceiling (no DB added to the stateless ACL); upgrade path documented. Recorded in **ADR-0026**.

## Verified locally

lint (`dotnet format`) ✓ · .NET unit — acl 60 / bff 45 / domain 152 / event-subscriber 19 / acceptance 17 ✓ · frontend lint+test (8 projects) ✓ · beheer build ✓. Clean full-solution build (caught + fixed the acceptance `AclService` ctor drift). TDD red→green per layer (ACL store, ACL endpoints, BFF, frontend).

## Definition of Done

- [x] Failing test committed before each implementation (red→green per layer).
- [x] Conventional Commits referencing #131.
- [ ] CI green — see note below.
- [x] Docs: ADR-0026 + S-15b demo note.
- [x] Demo note in `docs/demo-script.md`.

## Note on CI

The bulk validates in the fast jobs (lint/build/unit/frontend/mutation). The **verify-stack e2e** (incl. the new `default-fill.spec.ts`) can't go green until the pre-existing **verify-stack bring-up failure on the 1.27/2.0.0 runner** is resolved (that fails on plain `main` too — unrelated to this PR). Additive change; no existing e2e touched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #138

services/acl/Acl.Tests/AclServiceTests.cs

@@ -84,8 +84,11 @@ public class AclServiceTests
         InformatieobjecttypeOmschrijving = "Diploma",
     };
 
+    private static InMemoryDefaultFillStore FillFrom(AclDefaults d) =>
+        new(new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
+
     private static AclService ServiceWith(FakeGateway gateway, AclDefaults defaults, DateOnly today) =>
-        new(gateway, defaults, new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
+        new(gateway, FillFrom(defaults), new CachedZaaktypeCatalog(gateway, defaults), new FixedClock(today));
 
     private sealed class FixedClock(DateOnly today) : IClock
     {
@@ -113,6 +116,22 @@ public class AclServiceTests
         Assert.Equal("reg-77", req.Identificatie);
     }
 
+    [Fact]
+    public async Task Opening_a_zaak_reflects_a_default_fill_update(/* S-15b */)
+    {
+        var gateway = new FakeGateway();
+        var service = ServiceWith(gateway, Defaults(), new DateOnly(2026, 6, 4));
+
+        // A beheerder edits the default-fill; the very next zaak must use the new values (read per zaak).
+        service.UpdateDefaultFill(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
+        await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-1"));
+
+        var req = gateway.Captured!;
+        Assert.Equal("999999999", req.Bronorganisatie);
+        Assert.Equal("888888888", req.VerantwoordelijkeOrganisatie);
+        Assert.Equal("vertrouwelijk", req.Vertrouwelijkheidaanduiding);
+    }
+
     [Fact]
     public async Task Rejects_a_null_registration_without_calling_the_gateway()
     {

services/acl/Acl.Tests/DefaultFillStoreTests.cs

@@ -0,0 +1,29 @@
+using Acl.Application;
+
+namespace Acl.Tests;
+
+public class DefaultFillStoreTests
+{
+    private static DefaultFillSettings Seed() => new("517439943", "517439943", "openbaar");
+
+    [Fact]
+    public void Seeds_from_the_supplied_settings()
+    {
+        var store = new InMemoryDefaultFillStore(Seed());
+
+        Assert.Equal("517439943", store.Current.Bronorganisatie);
+        Assert.Equal("openbaar", store.Current.Vertrouwelijkheidaanduiding);
+    }
+
+    [Fact]
+    public void Updating_replaces_the_current_settings()
+    {
+        var store = new InMemoryDefaultFillStore(Seed());
+
+        store.Update(new DefaultFillSettings("999999999", "888888888", "vertrouwelijk"));
+
+        Assert.Equal("999999999", store.Current.Bronorganisatie);
+        Assert.Equal("888888888", store.Current.VerantwoordelijkeOrganisatie);
+        Assert.Equal("vertrouwelijk", store.Current.Vertrouwelijkheidaanduiding);
+    }
+}