feat(domain): ApproveRegistration use case + temp /registrations/{id}/approve endpoint (refs #75)

Loads the registration, asks the ACL to set its zaak's final status (new
IAclClient.ApproveZaakAsync → POST /statussen), then advances the aggregate to
INGESCHREVEN. Idempotent: a repeated approval is a no-op. Adds HTTP-adapter tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -23,6 +23,7 @@ builder.Services.AddTransient<IExternalWorkerClient>(sp => sp.GetRequiredService
 builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 
 builder.Services.AddScoped<SubmitRegistration>();
+builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
 
@@ -42,6 +43,18 @@ app.MapPost("/registrations", async (SubmitRegistrationRequest body, SubmitRegis
     return Results.Accepted($"/registrations/{id}", new RegistrationResponse(id.ToString(), RegistrationStatus.Ingediend.ToString(), null));
 });
 
+// Temporary admin endpoint (S-09b): approve a registration — the behandelaar's decision, until the
+// behandel-portal exists (S-12). The zaak's final status is set via the ACL, which flows back over
+// NRC to the projection, making the entry publicly visible as INGESCHREVEN. Idempotent.
+app.MapPost("/registrations/{id}/approve", async (string id, ApproveRegistration approve, CancellationToken ct) =>
+{
+    if (!Guid.TryParse(id, out var guid))
+        return Results.NotFound();
+
+    await approve.HandleAsync(new ApproveRegistrationCommand(new RegistrationId(guid)), ct);
+    return Results.NoContent();
+});
+
 // Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
 app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
 {