feat(portal-beheer): ACL default-fill configuration editor (closes #131) (#138)

## What & why

S-15b, second of the S-15 (#16) split, on top of S-15a (#133). A beheerder edits the ACL's ZGW **default-fill** values from the beheer portal, and the next zaak is stamped with the new values — no restart.

Closes #131

### The vertical

portal → BFF `GET/PUT /beheer/default-fill` (medewerker realm + `beheerder` role) → ACL `GET/PUT /default-fill` → a runtime-mutable in-memory store the ACL reads **per zaak**.

- **ACL**: `IDefaultFillStore` / `InMemoryDefaultFillStore` (thread-safe, seeded from `Acl:Defaults`); `AclService` reads `fill.Current` per zaak (not cached at construction); `GET`/`PUT /default-fill` with required-field validation.
- **BFF**: `IAclClient` gains `GetDefaultFillAsync`/`UpdateDefaultFillAsync`; `GET`/`PUT /beheer/default-fill` behind the `beheerder` policy. OpenAPI + generated client regenerated.
- **Frontend**: a *Default-fill* editor page in the beheer app (load → edit → save, with saved/failure states) + nav between Catalogus and Default-fill.

### Scope decision → ADR-0026

Only the **three ZGW fill fields** (bronorganisatie, verantwoordelijke organisatie, vertrouwelijkheidaanduiding) are editable. The S-27 catalog-resolution keys stay **static config** — editing them would desync the zaaktype-URL cache (ADR-0021), and they're catalogus wiring, not "default fill". The store is **in-memory** (seeded from config): an edit reverts on restart. That's the reference-app-appropriate ceiling (no DB added to the stateless ACL); upgrade path documented. Recorded in **ADR-0026**.

## Verified locally

lint (`dotnet format`) ✓ · .NET unit — acl 60 / bff 45 / domain 152 / event-subscriber 19 / acceptance 17 ✓ · frontend lint+test (8 projects) ✓ · beheer build ✓. Clean full-solution build (caught + fixed the acceptance `AclService` ctor drift). TDD red→green per layer (ACL store, ACL endpoints, BFF, frontend).

## Definition of Done

- [x] Failing test committed before each implementation (red→green per layer).
- [x] Conventional Commits referencing #131.
- [ ] CI green — see note below.
- [x] Docs: ADR-0026 + S-15b demo note.
- [x] Demo note in `docs/demo-script.md`.

## Note on CI

The bulk validates in the fast jobs (lint/build/unit/frontend/mutation). The **verify-stack e2e** (incl. the new `default-fill.spec.ts`) can't go green until the pre-existing **verify-stack bring-up failure on the 1.27/2.0.0 runner** is resolved (that fails on plain `main` too — unrelated to this PR). Additive change; no existing e2e touched.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #138

tests/acceptance/Steps/EenZaakOpenenSteps.cs

@@ -44,7 +44,9 @@ public sealed class EenZaakOpenenSteps
     [When("the domain asks the ACL to open a zaak")]
     public async Task WhenTheDomainAsksTheAclToOpenAZaak()
     {
-        var service = new AclService(_gateway, _defaults!, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
+        var fill = new InMemoryDefaultFillStore(new DefaultFillSettings(
+            _defaults!.Bronorganisatie, _defaults.VerantwoordelijkeOrganisatie, _defaults.Vertrouwelijkheidaanduiding));
+        var service = new AclService(_gateway, fill, new CachedZaaktypeCatalog(_gateway, _defaults!), new FixedClock(_today));
         _returnedUrl = await service.OpenZaakAsync(_registration!);
     }
 

tests/e2e/default-fill.spec.ts

@@ -0,0 +1,26 @@
+import { expect, test } from '@playwright/test';
+
+// S-15b: a beheerder edits the ACL default-fill in the beheer portal and gets a saved confirmation.
+// Runs against the shared verify stack; it edits + saves (the ACL store is in-memory, ADR-0026) and
+// asserts the confirmation, without depending on another test's state.
+test('a beheerder edits and saves the default-fill', async ({ page }) => {
+  await page.goto('http://beheer/');
+
+  // Keycloak medewerker-realm login (same realm as behandel).
+  await page.locator('#username').fill('bram-beheerder');
+  await page.locator('#password').fill('test123');
+  await page.locator('#kc-login').click();
+
+  await expect(page.getByRole('heading', { name: /Catalogus/i })).toBeVisible();
+
+  // Navigate to the default-fill editor and change a value.
+  await page.getByRole('link', { name: /Default-fill/i }).click();
+  await expect(page.getByRole('heading', { name: /Default-fill/i })).toBeVisible();
+
+  const bron = page.getByLabel('Bronorganisatie');
+  await expect(bron).toBeVisible();
+  await bron.fill('517439943');
+  await page.getByRole('button', { name: /Opslaan/i }).click();
+
+  await expect(page.getByText(/standaardwaarden zijn opgeslagen/i)).toBeVisible();
+});