feat(bff): owner-scoped self-service withdraw endpoint (S-11c-1, refs #12) (#90)

## What & why

Third sub-slice of **S-11 · Withdrawal (Flow 3)** (#12) — the **owner-scoped BFF withdraw endpoint** (backend). S-11a/b made a withdrawal transition the aggregate and cancel the workflow; this adds the citizen-facing entry point through the BFF, gated to the registration's owner.

- **Domain**: `WithdrawRegistrationCommand` carries the caller's `bsn`; the handler returns a `WithdrawOutcome` and refuses a bsn that doesn't own the registration. Unknown and not-owned are **both 404** (indistinguishable — ownership isn't revealed). `POST /registrations/{id}/withdraw` takes `{bsn}` and maps the outcome (204/404).
- **BFF**: `POST /self-service/registrations/{id}/withdraw` (DigiD-authenticated) forwards the token's `bsn` to the domain and relays 204/404. The BFF authenticates; the domain owner-scopes (an aggregate invariant, not the domain doing auth).
- OpenAPI spec + Angular client regenerated for the new endpoint.
- `run-domain-check.sh` withdrawal step now sends the owner `bsn` (verify-stack).

Refs #12 — the self-service "trek aanvraag in" button + e2e (S-11c-2) closes it.

## Definition of Done

- [x] Linked Gitea issue (#12).
- [x] Failing tests committed before the implementation.
- [x] Implementation makes the tests pass.
- [x] Conventional Commits referencing the issue (`refs #12`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` unaffected.
- [x] No ADR needed (owner-scoping is an aggregate invariant; no boundary change).
- [x] Docs — the user-visible demo note lands with S-11c-2.

## Notes for reviewers

- **Full local gate run before pushing this time** (lessons from #89): `dotnet format --verify-no-changes` clean; `make unit` green — Acl 27, EventSubscriber 19, BFF 30, Acceptance 9, Big 95; `api-client` lint+test green.
- Owner mismatch returns 404 (not 403) so the portal can't be used to probe which references exist.

Reviewed-on: #90

services/domain/Big.Tests/WithdrawRegistrationTests.cs

@@ -5,13 +5,17 @@ namespace Big.Tests;
 
 public class WithdrawRegistrationTests
 {
+    private const string Bsn = "123456782";
+
     private static Registration Submitted(string processInstanceId = "proc-1")
     {
-        var registration = Registration.Submit("123456782");
+        var registration = Registration.Submit(Bsn);
         registration.RecordProcessStarted(processInstanceId);
         return registration;
     }
 
+    private static WithdrawRegistrationCommand Command(RegistrationId id, string bsn = Bsn) => new(id, bsn);
+
     [Fact]
     public async Task Withdrawing_marks_the_registration_ingetrokken_and_persists_it()
     {
@@ -20,8 +24,9 @@ public class WithdrawRegistrationTests
         store.Seed(registration);
         var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
 
-        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+        var outcome = await handler.HandleAsync(Command(registration.Id));
 
+        Assert.Equal(WithdrawOutcome.Withdrawn, outcome);
         var saved = await store.GetAsync(registration.Id);
         Assert.Equal(RegistrationStatus.Ingetrokken, saved!.Status);
         Assert.Equal(1, store.SaveCount);
@@ -36,7 +41,7 @@ public class WithdrawRegistrationTests
         var workflow = new FakeWorkflowClient();
         var handler = new WithdrawRegistration(store, workflow);
 
-        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+        await handler.HandleAsync(Command(registration.Id));
 
         // The process the registration recorded at submit is cancelled (ADR-0014).
         Assert.Equal("proc-42", workflow.WithdrawnProcessInstanceId);
@@ -45,20 +50,37 @@ public class WithdrawRegistrationTests
     [Fact]
     public async Task Withdrawing_before_a_process_was_started_still_marks_ingetrokken()
     {
-        // A registration with no recorded process (e.g. start never happened) can still be withdrawn;
-        // there is simply no process to cancel.
         var store = new FakeRegistrationStore();
-        var registration = Registration.Submit("123456782"); // no RecordProcessStarted
+        var registration = Registration.Submit(Bsn); // no RecordProcessStarted
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var handler = new WithdrawRegistration(store, workflow);
 
-        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+        await handler.HandleAsync(Command(registration.Id));
 
         Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
         Assert.Null(workflow.WithdrawnProcessInstanceId);
     }
 
+    [Fact]
+    public async Task A_different_bsn_cannot_withdraw_the_registration()
+    {
+        // Owner-scoping: only the zorgprofessional who submitted may withdraw. Another bsn is told
+        // NotFound (we don't reveal the registration exists) and nothing is changed.
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var handler = new WithdrawRegistration(store, workflow);
+
+        var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
+
+        Assert.Equal(WithdrawOutcome.NotFound, outcome);
+        Assert.Equal(RegistrationStatus.Ingediend, (await store.GetAsync(registration.Id))!.Status);
+        Assert.Equal(0, store.SaveCount);
+        Assert.Null(workflow.WithdrawnProcessInstanceId);
+    }
+
     [Fact]
     public async Task Rejects_a_null_command_without_touching_the_store()
     {
@@ -70,14 +92,14 @@ public class WithdrawRegistrationTests
     }
 
     [Fact]
-    public async Task Withdrawing_an_unknown_registration_throws()
+    public async Task Withdrawing_an_unknown_registration_is_not_found()
     {
         var store = new FakeRegistrationStore();
         var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
 
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => handler.HandleAsync(new WithdrawRegistrationCommand(RegistrationId.New())));
-        Assert.Contains("No registration", ex.Message);
+        var outcome = await handler.HandleAsync(Command(RegistrationId.New()));
+
+        Assert.Equal(WithdrawOutcome.NotFound, outcome);
         Assert.Equal(0, store.SaveCount);
     }
 
@@ -90,10 +112,11 @@ public class WithdrawRegistrationTests
         var workflow = new FakeWorkflowClient();
         var handler = new WithdrawRegistration(store, workflow);
 
-        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
-        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+        await handler.HandleAsync(Command(registration.Id));
+        var second = await handler.HandleAsync(Command(registration.Id));
 
-        // The second withdrawal is a no-op: the aggregate is not persisted again.
+        // The second withdrawal is a no-op: still Withdrawn, but the aggregate is not persisted again.
+        Assert.Equal(WithdrawOutcome.Withdrawn, second);
         Assert.Equal(1, store.SaveCount);
         Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
     }