test(bff): endpoints, JWT auth and public-safe projection (refs #8)

Failing tests for the BFF walking-skeleton endpoints:
- POST /self-service/registrations rejects missing/malformed/wrong-key/expired
  tokens (401) and, with a valid digid token, forwards the bsn to the domain and
  returns 202 (WebApplicationFactory + a local test signing key, ADR-0010).
- GET /openbaar/register serves public-safe rows anonymously (never the bsn) and
  filters by q.
- OpenbaarProjection.PublicView (pure) filters by id and maps to id+status only.

Endpoints and PublicView are stubs so the tests compile and fail on their
assertions; the green commit implements them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Api/DownstreamClients.cs

@@ -0,0 +1,47 @@
+using System.Net.Http.Json;
+
+namespace Bff.Api;
+
+/// <summary>What the self-service submit returns to the portal (the domain's registration id + status).</summary>
+public sealed record SubmitAccepted(string RegistrationId, string Status);
+
+/// <summary>A projection row as the projection-api serves it. <c>Bsn</c>/<c>NaamPlaceholder</c> are
+/// read but never surfaced by the openbaar endpoint (public-safe filtering, ADR-0010/S-09).</summary>
+public sealed record ProjectionEntry(string Id, string Status, string? Bsn, string? NaamPlaceholder);
+
+/// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
+public sealed record OpenbaarEntry(string Id, string Status);
+
+/// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
+public interface IDomainClient
+{
+    Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
+}
+
+/// <summary>Port to the read projection.</summary>
+public interface IProjectionClient
+{
+    Task<IReadOnlyList<ProjectionEntry>> GetRegisterAsync(CancellationToken ct = default);
+}
+
+/// <summary>Calls the Domain Service's <c>POST /registrations</c>.</summary>
+public sealed class DomainClient(HttpClient http) : IDomainClient
+{
+    public async Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
+    {
+        using var response = await http.PostAsJsonAsync("registrations", new { bsn }, ct);
+        response.EnsureSuccessStatusCode();
+        var dto = await response.Content.ReadFromJsonAsync<DomainResponse>(ct)
+            ?? throw new InvalidOperationException("The Domain Service returned an empty registration response.");
+        return new SubmitAccepted(dto.RegistrationId, dto.Status);
+    }
+
+    private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
+}
+
+/// <summary>Calls the projection-api's <c>GET /register</c>.</summary>
+public sealed class ProjectionClient(HttpClient http) : IProjectionClient
+{
+    public async Task<IReadOnlyList<ProjectionEntry>> GetRegisterAsync(CancellationToken ct = default)
+        => await http.GetFromJsonAsync<List<ProjectionEntry>>("register", ct) ?? [];
+}