feat(acl,domain): cancel the ZGW zaak on document-timeout expiry (S-10c, closes #106) (#109)

## S-10c · Close the ZGW zaak on document-timeout expiry (closes #106)

Completes the S-10a/S-10b boundary flagged in ADR-0017: when a registration's 30-day document term lapses, the domain now cancels the **ZGW zaak** as well as marking the aggregate `Verlopen`, so OpenZaak and the register no longer diverge.

### What it does
On expiry the `ExpireRegistrationWorker` calls the ACL to set the zaak to a distinct, non-terminal **`Geannuleerd`** status with a **`Vervallen`** resultaat (vs the approval `Afgehandeld` + `Geregistreerd`), resolved **by omschrijving** in the ACL — the ACL-first ordering mirrors approval so a failed ZGW call leaves the job for redelivery rather than diverging the two.

**Path:** Flowable P30D timer → `RegistratieVerlopen` job → domain `ExpireRegistrationWorker` → ACL `POST /annuleringen` → ZGW `resultaten` + `statussen` (Geannuleerd) → aggregate `Verlopen`.

### Layers touched (each red→green)
- **ACL gateway** — `SetZaakToCancellationStatusAsync` (Geannuleerd + Vervallen by name); approval now resolves its `Geregistreerd` resultaat by name too (a second resultaattype now exists).
- **ACL service/API** — `AclService.CancelZaakAsync` + `POST /annuleringen`.
- **Domain** — `IAclClient.CancelZaakAsync` + client; expiry worker cancels the zaak before advancing to `Verlopen`, guarded against redelivery double-cancel.
- **Seed** — non-terminal `Geannuleerd` statustype (volgnummer 2; `Afgehandeld` → 3) + `Vervallen` resultaattype, both idempotent by omschrijving and sharing the zaaktype's procestype.
- **Verify/integration** — ACL↔OpenZaak integration test (live `Geannuleerd` + resultaat); `run-domain-check.sh` fires the real P30D timer and asserts the zaak reaches `Geannuleerd` end-to-end; BDD scenario asserts cancel-on-timeout vs untouched-when-in-time.
- **Docs** — ADR-0019 (cancellation modelling decision), demo-script, BACKLOG.

### Design note (ADR-0019)
ZGW allows only one eindstatus per zaaktype, so `Geannuleerd` is modelled as a **non-terminal** status (it records a cancellation status + resultaat but does not set `einddatum`). This follows the issue's explicit "distinct statustype + resultaat" outcome; the shared-eindstatus alternative is recorded in the ADR.

### Tests
Unit + acceptance all green locally (Acl 38, Big 134, Acceptance 17, Bff 33, EventSubscriber 19). Integration + verify-stack run in CI (need live OpenZaak + selectielijst egress).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #109

tests/acceptance/Features/EenDocumentTermijnVerlopen.feature

@@ -14,6 +14,7 @@ Feature: Een documenttermijn laten verlopen
     When the 30-day document timer fires
     And the document-timeout worker runs
     Then the registration is verlopen
+    And the zaak is cancelled in ZGW
 
   Scenario: Tijdig aangeleverde documenten laten de registratie niet vervallen
     Given a registration parked at the WachtOpDocumenten task
@@ -21,3 +22,4 @@ Feature: Een documenttermijn laten verlopen
     And the 30-day document timer fires
     And the document-timeout worker runs
     Then the registration is not verlopen
+    And the zaak is not cancelled in ZGW

tests/acceptance/Steps/EenDocumentTermijnVerlopenSteps.cs

@@ -17,8 +17,11 @@ namespace Acceptance.Steps;
 [Scope(Feature = "Een documenttermijn laten verlopen")]
 public sealed class EenDocumentTermijnVerlopenSteps
 {
+    private static readonly Uri ZaakUrl = new("http://openzaak/zaken/api/v1/zaken/acc-timeout");
+
     private readonly InMemoryDocumentTimeoutClient _flowable = new();
     private readonly Support.InMemoryRegistrationStore _store = new();
+    private readonly InMemoryAclClient _acl = new();
     private Registration _registration = null!;
     private string _processInstanceId = "";
 
@@ -26,6 +29,9 @@ public sealed class EenDocumentTermijnVerlopenSteps
     public async Task GivenARegistrationParkedAtWachtOpDocumenten()
     {
         _registration = Registration.Submit("123456782");
+        // By the time it parks at WachtOpDocumenten its zaak has been opened (OpenZaakAanmaken runs
+        // earlier), so a timeout has a zaak to cancel.
+        _registration.AttachZaak(ZaakUrl);
         await _store.SaveAsync(_registration);
         _processInstanceId = _flowable.ParkWaitingForDocuments(_registration.Id);
     }
@@ -39,7 +45,7 @@ public sealed class EenDocumentTermijnVerlopenSteps
     [When("the document-timeout worker runs")]
     public async Task WhenTheTimeoutWorkerRuns()
         => await new RegistratieVerlopenProcessor(
-            _flowable, new ExpireRegistrationWorker(_store),
+            _flowable, new ExpireRegistrationWorker(_store, _acl),
             NullLogger<RegistratieVerlopenProcessor>.Instance).PumpOnceAsync(5);
 
     [Then("the registration is verlopen")]
@@ -49,4 +55,10 @@ public sealed class EenDocumentTermijnVerlopenSteps
     [Then("the registration is not verlopen")]
     public async Task ThenTheRegistrationIsNotVerlopen()
         => Assert.Equal(RegistrationStatus.Ingediend, (await _store.GetAsync(_registration.Id))!.Status);
+
+    [Then("the zaak is cancelled in ZGW")]
+    public void ThenTheZaakIsCancelled() => Assert.Equal(ZaakUrl, _acl.CancelledZaakUrl);
+
+    [Then("the zaak is not cancelled in ZGW")]
+    public void ThenTheZaakIsNotCancelled() => Assert.Null(_acl.CancelledZaakUrl);
 }

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -60,6 +60,14 @@ public sealed class InMemoryAclClient : IAclClient
         return Task.CompletedTask;
     }
 
+    public Uri? CancelledZaakUrl { get; private set; }
+
+    public Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        CancelledZaakUrl = zaakUrl;
+        return Task.CompletedTask;
+    }
+
     public (Uri ZaakUrl, string FileName)? StoredDiploma { get; private set; }
 
     public Task<Uri> StoreDiplomaAsync(Uri zaakUrl, byte[] content, string fileName, string contentType, CancellationToken ct = default)

tests/acceptance/Support/InMemoryZaakGateway.cs

@@ -12,6 +12,7 @@ public sealed class InMemoryZaakGateway : IZaakGateway
 
     public ZaakRequest? Captured { get; private set; }
     public (Uri Zaak, Uri Zaaktype, DateOnly Datum)? Approved { get; private set; }
+    public (Uri Zaak, Uri Zaaktype, DateOnly Datum)? Cancelled { get; private set; }
 
     public Task<Uri> OpenZaakAsync(ZaakRequest request, CancellationToken ct = default)
     {
@@ -25,6 +26,12 @@ public sealed class InMemoryZaakGateway : IZaakGateway
         return Task.CompletedTask;
     }
 
+    public Task SetZaakToCancellationStatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default)
+    {
+        Cancelled = (zaakUrl, zaaktypeUrl, datumStatusGezet);
+        return Task.CompletedTask;
+    }
+
     public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
         => Task.FromResult("ACC-REF-1");