feat(domain): ProvideDocuments stores the diploma via the ACL then completes the wait (refs #103)

IAclClient.StoreDiplomaAsync + AclHttpClient (base64 JSON to the ACL /documenten
endpoint). ProvideDocuments stores the uploaded bytes against the zaak (when opened)
before completing WachtOpDocumenten; the domain endpoint accepts the file base64-encoded.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -120,8 +120,17 @@ app.MapPost("/registrations/{id}/documents", async (string id, ProvideDocumentsR
 
     if (string.IsNullOrWhiteSpace(body?.Bsn))
         return Results.BadRequest(new { error = "A bsn is required to provide documents." });
+    if (string.IsNullOrWhiteSpace(body.ContentBase64))
+        return Results.BadRequest(new { error = "A document is required." });
 
-    var outcome = await provide.HandleAsync(new ProvideDocumentsCommand(new RegistrationId(guid), body.Bsn), ct);
+    byte[] content;
+    try { content = Convert.FromBase64String(body.ContentBase64); }
+    catch (FormatException) { return Results.BadRequest(new { error = "The document content is not valid base64." }); }
+
+    var command = new ProvideDocumentsCommand(
+        new RegistrationId(guid), body.Bsn, content,
+        body.FileName ?? "diploma.pdf", body.ContentType ?? "application/pdf");
+    var outcome = await provide.HandleAsync(command, ct);
     return outcome == ProvideDocumentsOutcome.Accepted ? Results.NoContent() : Results.NotFound();
 });
 
@@ -152,7 +161,7 @@ public sealed record DecideRequest(string Besluit);
 
 public sealed record WithdrawRequest(string Bsn);
 
-public sealed record ProvideDocumentsRequest(string Bsn);
+public sealed record ProvideDocumentsRequest(string Bsn, string ContentBase64, string? FileName = null, string? ContentType = null);
 
 public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);