feat(#13): S-12b — Workflow Client user-tasks + Beoordelen userTask (#83)

## What & why

Second sub-slice of **S-12 (#13)** — the **Workflow Client gains behandelaar user-task operations**, and the process model gains the beoordeling step.

- **BPMN:** `registratie.bpmn` now parks at a `Beoordelen` **userTask** (candidate group `behandelaar`) after `OpenZaakAanmaken`; `registrationId` rides along as a process variable so the werkbak can correlate each task to its aggregate.
- **Workflow Client** (`IUserTaskClient`, the only code that talks to Flowable §8.2):
  - `GetOpenBeoordelingenAsync()` — the werkbak (open `Beoordelen` tasks + their `registrationId`)
  - `ClaimAsync(taskId, behandelaar)`
  - `CompleteBeoordelingAsync(taskId, besluit)` — carries the decision into the process as the `besluit` variable
- **Live integration:** `verify-domain` now drives the full user-task lifecycle against a real Flowable — after the worker opens the zaak, it polls for the task, claims it as `merel-behandelaar`, completes it (`goedkeuren`), and asserts the process finishes. This proves the exact REST contract (`service/runtime/tasks/query` + `…/{id}` claim/complete) the client depends on.

The walking skeleton is unaffected: the temporary `/approve` path still sets the zaak status directly; wiring the domain decision to *complete this task* (and driving the werkbak from the BFF) lands in **S-12c**.

## Definition of Done

- [x] Linked issue: #13 (umbrella; `refs`, does not close)
- [x] Tests first; red → green
- [x] Unit + acceptance green (`make unit`): domain 76, acceptance 9 (acl/event-subscriber/bff unaffected)
- [x] Mutation ≥ break(90): **domain 100%** (killed the new survivors *and* the pre-existing `FlowableWorkflowClient` baseline)
- [x] Live Flowable user-task lifecycle asserted in `verify-domain`
- [ ] CI green (pending)

Part of #13.

Reviewed-on: #83

services/domain/Big.Infrastructure/FlowableWorkflowClient.cs

@@ -15,12 +15,14 @@ namespace Big.Infrastructure;
 /// The REST contract here is the one verified against a live flowable-rest engine (ADR-0009).
 /// </summary>
 public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions options)
-    : IWorkflowClient, IExternalWorkerClient
+    : IWorkflowClient, IExternalWorkerClient, IUserTaskClient
 {
     private const string Topic = "OpenZaakAanmaken";
     private const string ProcessDefinitionKey = "registratie";
+    private const string BeoordelenTaskKey = "Beoordelen";
     private const string RegistrationIdVariable = "registrationId";
     private const string ZaakUrlVariable = "zaakUrl";
+    private const string BesluitVariable = "besluit";
 
     public async Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
@@ -55,6 +57,34 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         response.EnsureSuccessStatusCode();
     }
 
+    public async Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
+    {
+        var request = new TaskQueryRequest(ProcessDefinitionKey, BeoordelenTaskKey, IncludeProcessVariables: true);
+
+        var page = await PostAsync<TaskQueryRequest, TaskQueryResult>(
+            "service/query/tasks", request, ct);
+
+        var tasks = page?.Data ?? [];
+        return [.. tasks.Select(t => new BeoordelingTask(t.Id, RegistrationId.Parse(t.RegistrationId())))];
+    }
+
+    public async Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default)
+    {
+        using var response = await SendAsync(
+            $"service/runtime/tasks/{taskId}", new ClaimTaskRequest("claim", behandelaar), ct);
+        response.EnsureSuccessStatusCode();
+    }
+
+    public async Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
+    {
+        var request = new CompleteTaskRequest(
+            "complete",
+            [new Variable(BesluitVariable, "string", besluit.ToString().ToLowerInvariant())]);
+
+        using var response = await SendAsync($"service/runtime/tasks/{taskId}", request, ct);
+        response.EnsureSuccessStatusCode();
+    }
+
     private async Task<TResponse?> PostAsync<TRequest, TResponse>(string path, TRequest body, CancellationToken ct)
     {
         using var response = await SendAsync(path, body, ct);
@@ -89,6 +119,34 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         [property: JsonPropertyName("workerId")] string WorkerId,
         [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
 
+    private sealed record TaskQueryRequest(
+        [property: JsonPropertyName("processDefinitionKey")] string ProcessDefinitionKey,
+        [property: JsonPropertyName("taskDefinitionKey")] string TaskDefinitionKey,
+        [property: JsonPropertyName("includeProcessVariables")] bool IncludeProcessVariables);
+
+    private sealed record ClaimTaskRequest(
+        [property: JsonPropertyName("action")] string Action,
+        [property: JsonPropertyName("assignee")] string Assignee);
+
+    private sealed record CompleteTaskRequest(
+        [property: JsonPropertyName("action")] string Action,
+        [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
+
+    private sealed record TaskQueryResult(
+        [property: JsonPropertyName("data")] IReadOnlyList<UserTaskDto>? Data);
+
+    private sealed record UserTaskDto(
+        [property: JsonPropertyName("id")] string Id,
+        // Flowable's task-query returns the (included) process variables under "variables", not
+        // "processVariables"; the request opts in via includeProcessVariables.
+        [property: JsonPropertyName("variables")] IReadOnlyList<Variable>? Variables)
+    {
+        /// <summary>The registration id this task carries as a process variable.</summary>
+        public string RegistrationId() =>
+            Variables?.SingleOrDefault(v => v.Name == "registrationId")?.Value
+            ?? throw new InvalidOperationException($"Beoordelen task {Id} carries no registrationId variable.");
+    }
+
     private sealed record Variable(
         [property: JsonPropertyName("name")] string Name,
         [property: JsonPropertyName("type")] string Type,