feat(domain): ApproveRegistration use case + temp /registrations/{id}/approve endpoint (refs #75)

Loads the registration, asks the ACL to set its zaak's final status (new
IAclClient.ApproveZaakAsync → POST /statussen), then advances the aggregate to
INGESCHREVEN. Idempotent: a repeated approval is a no-op. Adds HTTP-adapter tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Application/ApproveRegistration.cs

@@ -0,0 +1,36 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>A behandelaar's decision to approve a registration, in domain language.</summary>
+public sealed record ApproveRegistrationCommand(RegistrationId RegistrationId);
+
+/// <summary>
+/// The approve use case (S-09b): set the registration's zaak to its final status via the ACL (§8.1),
+/// then advance the aggregate to INGESCHREVEN. Idempotent — a redelivered or repeated approval of an
+/// already-approved registration is a no-op, so the ACL is not asked to set the status twice. The
+/// zaak status is the projection's source of truth (it flows back over NRC); the aggregate transition
+/// keeps the domain's own view consistent.
+/// </summary>
+public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl)
+{
+    public async Task HandleAsync(ApproveRegistrationCommand command, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(command);
+
+        var registration = await store.GetAsync(command.RegistrationId, ct)
+            ?? throw new InvalidOperationException($"No registration {command.RegistrationId} to approve.");
+
+        // A repeated approval is a no-op: don't set the zaak status a second time.
+        if (registration.Status == RegistrationStatus.Ingeschreven)
+            return;
+
+        if (registration.ZaakUrl is null)
+            throw new InvalidOperationException(
+                $"Registration {command.RegistrationId} has no zaak yet; it cannot be approved.");
+
+        await acl.ApproveZaakAsync(registration.ZaakUrl, ct);
+        registration.Approve();
+        await store.SaveAsync(registration, ct);
+    }
+}

services/domain/Big.Application/Ports.cs

@@ -25,6 +25,12 @@ public interface IWorkflowClient
 public interface IAclClient
 {
     Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default);
+
+    /// <summary>
+    /// Record the approval on the given zaak. The ACL translates this to the ZGW concept — setting
+    /// the zaak's final status — which OpenZaak notifies over NRC; the domain never names statustypen.
+    /// </summary>
+    Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default);
 }
 
 /// <summary>