feat(#13): S-12b — Workflow Client user-tasks + Beoordelen userTask (#83)

## What & why

Second sub-slice of **S-12 (#13)** — the **Workflow Client gains behandelaar user-task operations**, and the process model gains the beoordeling step.

- **BPMN:** `registratie.bpmn` now parks at a `Beoordelen` **userTask** (candidate group `behandelaar`) after `OpenZaakAanmaken`; `registrationId` rides along as a process variable so the werkbak can correlate each task to its aggregate.
- **Workflow Client** (`IUserTaskClient`, the only code that talks to Flowable §8.2):
  - `GetOpenBeoordelingenAsync()` — the werkbak (open `Beoordelen` tasks + their `registrationId`)
  - `ClaimAsync(taskId, behandelaar)`
  - `CompleteBeoordelingAsync(taskId, besluit)` — carries the decision into the process as the `besluit` variable
- **Live integration:** `verify-domain` now drives the full user-task lifecycle against a real Flowable — after the worker opens the zaak, it polls for the task, claims it as `merel-behandelaar`, completes it (`goedkeuren`), and asserts the process finishes. This proves the exact REST contract (`service/runtime/tasks/query` + `…/{id}` claim/complete) the client depends on.

The walking skeleton is unaffected: the temporary `/approve` path still sets the zaak status directly; wiring the domain decision to *complete this task* (and driving the werkbak from the BFF) lands in **S-12c**.

## Definition of Done

- [x] Linked issue: #13 (umbrella; `refs`, does not close)
- [x] Tests first; red → green
- [x] Unit + acceptance green (`make unit`): domain 76, acceptance 9 (acl/event-subscriber/bff unaffected)
- [x] Mutation ≥ break(90): **domain 100%** (killed the new survivors *and* the pre-existing `FlowableWorkflowClient` baseline)
- [x] Live Flowable user-task lifecycle asserted in `verify-domain`
- [ ] CI green (pending)

Part of #13.

Reviewed-on: #83

infra/run-domain-check.sh

@@ -51,18 +51,71 @@ loc="$(docker run --rm --network "$net" curlimages/curl:latest \
 echo ">> registration accepted at $loc"
 
 echo ">> polling the domain until the worker records the opened zaak"
+zaak_ok=""
 for _ in $(seq 1 30); do
   body="$(docker run --rm --network "$net" curlimages/curl:latest \
     -fsS "http://$dom_ip:8080$loc" 2>/dev/null || true)"
   if echo "$body" | grep -q '/zaken/api/v1/zaken/'; then
     echo "OK — the domain opened a zaak and recorded it on the registration:"
     echo "$body" | cut -c1-300
-    exit 0
+    zaak_ok=1
+    break
   fi
   sleep 2
 done
-echo "FAIL — the registration never received a zaak URL" >&2
-echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
-acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
-[ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
-exit 1
+if [ -z "$zaak_ok" ]; then
+  echo "FAIL — the registration never received a zaak URL" >&2
+  echo "--- domain log ---" >&2; docker logs "$dom" 2>&1 | tail -15 >&2
+  acl="$(docker ps -q --filter 'name=[-_]acl[-_]' | head -1)"
+  [ -n "$acl" ] && { echo "--- acl log ---" >&2; docker logs "$acl" 2>&1 | tail -15 >&2; }
+  exit 1
+fi
+
+# ── S-12b: the process now parks at the Beoordelen user task. Exercise the exact Flowable REST
+# contract the Workflow Client uses (query/claim/complete) against the live engine, reaching
+# flowable-rest by container IP (same in-network constraint as above). ──────────────────────────
+fl="$(docker ps -q --filter 'name=flowable-rest' | head -1)"
+[ -n "$fl" ] || { echo "ERROR: no running flowable-rest container" >&2; exit 1; }
+fl_base="http://$(ip "$fl"):8080/flowable-rest/service"
+reg_id="${loc##*/}"
+
+# Extracts the Beoordelen task id for our registration from a Flowable task-query response on stdin.
+# Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
+task_for_reg() { REG_ID="$reg_id" python3 -c "import os,sys,json
+try:
+    d=json.load(sys.stdin)
+except Exception:
+    d={}
+rid=os.environ['REG_ID']
+# Flowable's task-query returns the included process variables under 'variables'.
+print(next((t['id'] for t in (d.get('data') or [])
+    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), ''))"; }
+
+flcurl() { docker run --rm --network "$net" curlimages/curl:latest -fsS -u rest-admin:test "$@"; }
+query='{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen","includeProcessVariables":true}'
+
+echo ">> polling Flowable for the Beoordelen user task (werkbak)"
+task_id=""
+for _ in $(seq 1 30); do
+  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
+  task_id="$(printf '%s' "$resp" | task_for_reg)"
+  [ -n "$task_id" ] && break
+  sleep 2
+done
+[ -n "$task_id" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
+echo ">> Beoordelen task $task_id is waiting"
+
+echo ">> claiming the task as merel-behandelaar"
+flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
+  -d '{"action":"claim","assignee":"merel-behandelaar"}' >/dev/null
+
+echo ">> completing the beoordeling (goedkeuren)"
+flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/json' \
+  -d '{"action":"complete","variables":[{"name":"besluit","type":"string","value":"goedkeuren"}]}' >/dev/null
+
+echo ">> asserting the process finished (no Beoordelen task remains for the registration)"
+resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
+still="$(printf '%s' "$resp" | task_for_reg)"
+[ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
+echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
+exit 0