feat(domain,bff): current-registration lookup for self-service resume (refs #111)

Backend half of S-26. The domain gains IRegistrationStore.FindOpenByBsnAsync (the
citizen's non-terminal INGEDIEND/IN_BEHANDELING registration) + GET
/registrations/current?bsn=; the BFF adds owner-scoped GET /self-service/registrations
(bsn from the DigiD token) returning that registration or 204 when none. Regenerated
services/bff/openapi.json for the new endpoint (the api-client is generated from it).
Store + BFF endpoint unit tests; acceptance/BFF fakes updated for the new members.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/openapi.json

@@ -28,6 +28,32 @@
             "description": "Unauthorized"
           }
         }
+      },
+      "get": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CurrentRegistration"
+                }
+              }
+            }
+          },
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "description": "Bad Request"
+          },
+          "401": {
+            "description": "Unauthorized"
+          }
+        }
       }
     },
     "/self-service/registrations/{id}/withdraw": {
@@ -205,6 +231,21 @@
   },
   "components": {
     "schemas": {
+      "CurrentRegistration": {
+        "required": [
+          "registrationId",
+          "status"
+        ],
+        "type": "object",
+        "properties": {
+          "registrationId": {
+            "type": "string"
+          },
+          "status": {
+            "type": "string"
+          }
+        }
+      },
       "DecideRequest": {
         "required": [
           "besluit"