feat(bff): POST /behandel/registrations/{id}/decide behind the behandelaar policy (refs #13)

Forwards a behandelaar's goedkeuren/afwijzen to the domain (which applies the decision
and completes the workflow task). Validates the besluit vocabulary (400 on unknown)
without troubling the domain. openapi.json + api-client regenerated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/openapi.json

@@ -88,10 +88,62 @@
           }
         }
       }
+    },
+    "/behandel/registrations/{id}/decide": {
+      "post": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DecideRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "description": "Bad Request"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
     }
   },
   "components": {
     "schemas": {
+      "DecideRequest": {
+        "required": [
+          "besluit"
+        ],
+        "type": "object",
+        "properties": {
+          "besluit": {
+            "type": "string"
+          }
+        }
+      },
       "OpenbaarEntry": {
         "required": [
           "id",