feat(#13): S-12c-2 — behandel decide → domain + complete workflow task (#86)

## What & why

Second half of **S-12c** (behandel-portal backend), completing the decision path per **ADR-0013**:

- **Domain:** `BeoordeelRegistratie` now, after applying the decision (aggregate + ACL for approval), **completes the open Flowable `Beoordelen` task** for that registration (found by registrationId) with the besluit, so the workflow advances. No open task → the decision still stands (completes nothing); idempotent.
- **BFF:** `POST /behandel/registrations/{id}/decide` behind the medewerker/`behandelaar` policy, forwarding `goedkeuren`/`afwijzen` to the domain. Validates the besluit vocabulary (400 on unknown) without troubling the domain.

Behavior: decide is **401** without a token, **403** without the role, **400** for an unknown besluit, **204** (forwarded) for a behandelaar.

This completes the behandel backend. **S-12d** (the Angular behandel-portal + Playwright e2e) closes umbrella #13 and retires the temporary `/approve`.

## Definition of Done

- [x] Linked issue: #13 (umbrella, `refs`)
- [x] Tests first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 79, bff 27, acceptance 9 (acl/event-subscriber unaffected)
- [x] Beoordeling acceptance scenario asserts task completion (goedkeuren + afwijzen)
- [x] openapi.json + api-client regenerated (drift guard passes)
- [x] Mutation ≥ break(90): **domain 100%, bff 100%**
- [ ] CI green (pending)

Part of #13.

Reviewed-on: #86

services/domain/Big.Application/BeoordeelRegistratie.cs

@@ -20,10 +20,12 @@ public sealed record BeoordeelRegistratieCommand(RegistrationId RegistrationId,
 /// <see cref="BeoordelingsBesluit.Goedkeuren"/> sets the zaak's final status via the ACL (§8.1) and
 /// advances the aggregate to INGESCHREVEN; <see cref="BeoordelingsBesluit.Afwijzen"/> advances it to
 /// AFGEWEZEN in the domain (propagating a rejection to the zaak, so the openbaar projection reflects
-/// it, is a later sub-slice of S-12). Both decisions are idempotent — a repeated or redelivered
-/// decision that matches the current terminal state is a no-op, so the ACL is not called twice.
+/// it, is a later sub-slice of S-12). After applying the decision it completes the Flowable
+/// <c>Beoordelen</c> task (found by registrationId) so the workflow advances (ADR-0013). Both
+/// decisions are idempotent — a repeated or redelivered decision that matches the current terminal
+/// state is a no-op, so the ACL is not called and the task not completed twice.
 /// </summary>
-public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl)
+public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient acl, IUserTaskClient tasks)
 {
     public async Task HandleAsync(BeoordeelRegistratieCommand command, CancellationToken ct = default)
     {
@@ -53,5 +55,17 @@ public sealed class BeoordeelRegistratie(IRegistrationStore store, IAclClient ac
         }
 
         await store.SaveAsync(registration, ct);
+        await CompleteWorkflowTaskAsync(command.RegistrationId, command.Besluit, ct);
+    }
+
+    // Advance the workflow: complete the open Beoordelen task for this registration. If none is open
+    // (already completed, or the process hasn't parked yet) the decision still stands — we complete
+    // nothing rather than fail.
+    private async Task CompleteWorkflowTaskAsync(RegistrationId registrationId, BeoordelingsBesluit besluit, CancellationToken ct)
+    {
+        var open = await tasks.GetOpenBeoordelingenAsync(ct);
+        var task = open.FirstOrDefault(t => t.RegistrationId == registrationId);
+        if (task is not null)
+            await tasks.CompleteBeoordelingAsync(task.TaskId, besluit, ct);
     }
 }