feat(domain): herregistratie reminder sweep on a Quartz cron (S-17, closes #18) (#121)

## What & why

S-17: a BIG inscription is valid for a fixed term; before it lapses the zorgprofessional must herregistreren. This adds a **daily herregistratie reminder sweep**.

- **Domain:** `Approve(ingeschrevenOp)` now stamps the inscription moment; `HerregistratieVoor` derives the deadline (inscription + 5-year validity); `HerregistratieReminderDue(asOf)` is the single rule (inside the 90-day window, inscribed, not yet reminded); `MarkHerregistratieReminderVerstuurd()` is idempotent.
- **Store:** `FindDueForHerregistratieReminderAsync(asOf)` — the sweep's candidate set, filtered on the aggregate's own rule (no duplicated policy).
- **Application:** `HerregistratieReminderSweep` — pure over the store + an injected `TimeProvider`; flags + persists each due inscription, returns the reminded ids.
- **Infra/API:** `HerregistratieReminderJob` (Quartz `IJob`) fires the sweep on a daily cron (03:00, overridable via `Quartz__Cron`) and logs the count. `GET /registrations/{id}` surfaces `herregistratieVoor` + `herregistratieReminderVerstuurd`.

**Decisions (both raised with you before coding):** use Quartz.NET as the PRD names it — a genuine cron concern, distinct from the queue-draining pumps, which stay as-is (**ADR-0022**, proposal #120); and the reminder's observable effect is a flag on the aggregate + a log line (no outbound notification infra in v1). No coupling rule (§8) is touched — Quartz is internal to the Domain Service.

Closes #18
Closes #120

## Definition of Done

- [x] Linked Gitea issue (above).
- [x] Failing test committed before the implementation (red→green per layer: domain rule, store query, sweep).
- [x] Implementation makes the test pass; refactor commit for the 90-day knob.
- [x] Conventional Commits referencing the issue (`refs #18`).
- [ ] CI green — awaiting Gitea Actions.
- [ ] `docker compose up` reaches green health checks within 3 minutes — API boots locally with Quartz initialised; verified in CI compose smoke.
- [x] Docs updated — ADR-0022, demo-script, BACKLOG.
- [x] ADR added — `docs/architecture/adr-0022-quartz-scheduler.md`.
- [x] Demo note in `docs/demo-script.md`.

## Notes for reviewers

- **Ripple:** `Approve()` gained the inscription moment, so the two approving handlers (`ApproveRegistration`, `BeoordeelRegistratie`) now take an injected `TimeProvider`; existing tests pass a fixed clock. All three `IRegistrationStore` implementers (prod, unit fake, acceptance) got the new query.
- **Calibration knobs:** validity (5y) and reminder lead time (90d) are domain constants marked with `ponytail:` comments; promotion path to beheer config (S-15) noted in the ADR.
- **Mutation:** the Quartz job shell is excluded from Stryker, mirroring the pumps; all rule/sweep/query logic is covered.
- Local: 152 domain unit tests green; API boots with the Quartz scheduler and `/health` green.

Reviewed-on: #121

services/domain/Big.Application/ApproveRegistration.cs

@@ -12,7 +12,7 @@ public sealed record ApproveRegistrationCommand(RegistrationId RegistrationId);
 /// zaak status is the projection's source of truth (it flows back over NRC); the aggregate transition
 /// keeps the domain's own view consistent.
 /// </summary>
-public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl)
+public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl, TimeProvider clock)
 {
     public async Task HandleAsync(ApproveRegistrationCommand command, CancellationToken ct = default)
     {
@@ -30,7 +30,7 @@ public sealed class ApproveRegistration(IRegistrationStore store, IAclClient acl
                 $"Registration {command.RegistrationId} has no zaak yet; it cannot be approved.");
 
         await acl.ApproveZaakAsync(registration.ZaakUrl, ct);
-        registration.Approve();
+        registration.Approve(clock.GetUtcNow());
         await store.SaveAsync(registration, ct);
     }
 }

services/domain/Big.Application/BeoordeelRegistratie.cs

@@ -25,7 +25,7 @@ public sealed record BeoordeelRegistratieCommand(RegistrationId RegistrationId,
 /// decisions are idempotent — a repeated or redelivered decision that matches the current terminal
 /// state is a no-op, so the ACL is not called and the task not completed twice.
 /// </summary>
-public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks)
+public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks, TimeProvider clock)
 {
     public async Task HandleAsync(BeoordeelRegistratieCommand command, CancellationToken ct = default)
     {
@@ -44,7 +44,7 @@ public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient ac
                     throw new InvalidOperationException(
                         $"Registration {command.RegistrationId} has no zaak yet; it cannot be approved.");
                 await acl.ApproveZaakAsync(registration.ZaakUrl, ct);
-                registration.Approve();
+                registration.Approve(clock.GetUtcNow());
                 break;
 
             case BeoordelingsBesluit.Afwijzen:

services/domain/Big.Application/HerregistratieReminderSweep.cs

@@ -0,0 +1,30 @@
+using Big.Domain;
+
+namespace Big.Application;
+
+/// <summary>
+/// The herregistratie reminder sweep (S-17): find the inscriptions whose herregistratie deadline is
+/// within the reminder window and have not yet been reminded, mark each reminded, and persist it. Pure
+/// application logic over ports — it knows nothing of Quartz; the scheduled job that fires it on a cron
+/// lives in Infrastructure (mirroring how the pumps' processors are pure and the pump is the shell).
+/// Idempotent: <see cref="Registration.MarkHerregistratieReminderVerstuurd"/> drops an inscription from
+/// the next sweep's candidate set, so a re-fire reminds no one twice. Returns the reminded ids so the
+/// caller can observe the sweep's effect — the reminder itself is the flag persisted on the aggregate.
+/// </summary>
+public sealed class HerregistratieReminderSweep(IRegistrationStore store, TimeProvider clock)
+{
+    public async Task<IReadOnlyList<RegistrationId>> SweepAsync(CancellationToken ct = default)
+    {
+        var due = await store.FindDueForHerregistratieReminderAsync(clock.GetUtcNow(), ct);
+
+        var reminded = new List<RegistrationId>(due.Count);
+        foreach (var registration in due)
+        {
+            registration.MarkHerregistratieReminderVerstuurd();
+            await store.SaveAsync(registration, ct);
+            reminded.Add(registration.Id);
+        }
+
+        return reminded;
+    }
+}

services/domain/Big.Application/Ports.cs

@@ -107,6 +107,13 @@ public interface IRegistrationStore
     /// registration, or <c>null</c> if they have none in flight. Lets the self-service portal resume
     /// an existing registration after a refresh (S-26); terminal registrations are not resumed.</summary>
     Task<Registration?> FindOpenByBsnAsync(string bsn, CancellationToken ct = default);
+
+    /// <summary>The inscriptions whose herregistratie reminder is due as of <paramref name="asOf"/> and
+    /// not yet sent — the herregistratie reminder sweep's candidate set (S-17). The predicate is the
+    /// aggregate's own <see cref="Registration.HerregistratieReminderDue"/> rule, so the store never
+    /// duplicates the herregistratie policy.</summary>
+    Task<IReadOnlyList<Registration>> FindDueForHerregistratieReminderAsync(
+        DateTimeOffset asOf, CancellationToken ct = default);
 }
 
 /// <summary>