feat(#13): S-12c-2 — behandel decide → domain + complete workflow task (#86)

## What & why

Second half of **S-12c** (behandel-portal backend), completing the decision path per **ADR-0013**:

- **Domain:** `BeoordeelRegistratie` now, after applying the decision (aggregate + ACL for approval), **completes the open Flowable `Beoordelen` task** for that registration (found by registrationId) with the besluit, so the workflow advances. No open task → the decision still stands (completes nothing); idempotent.
- **BFF:** `POST /behandel/registrations/{id}/decide` behind the medewerker/`behandelaar` policy, forwarding `goedkeuren`/`afwijzen` to the domain. Validates the besluit vocabulary (400 on unknown) without troubling the domain.

Behavior: decide is **401** without a token, **403** without the role, **400** for an unknown besluit, **204** (forwarded) for a behandelaar.

This completes the behandel backend. **S-12d** (the Angular behandel-portal + Playwright e2e) closes umbrella #13 and retires the temporary `/approve`.

## Definition of Done

- [x] Linked issue: #13 (umbrella, `refs`)
- [x] Tests first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 79, bff 27, acceptance 9 (acl/event-subscriber unaffected)
- [x] Beoordeling acceptance scenario asserts task completion (goedkeuren + afwijzen)
- [x] openapi.json + api-client regenerated (drift guard passes)
- [x] Mutation ≥ break(90): **domain 100%, bff 100%**
- [ ] CI green (pending)

Part of #13.

Reviewed-on: #86

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -43,6 +43,29 @@ public sealed class InMemoryAclClient : IAclClient
     }
 }
 
+/// <summary>An in-memory user-task client for the beoordeling acceptance scenario: it holds one open
+/// Beoordelen task per registration and records the besluit each is completed with.</summary>
+public sealed class InMemoryUserTaskClient : IUserTaskClient
+{
+    private readonly List<BeoordelingTask> _open = [];
+
+    public (string TaskId, BeoordelingsBesluit Besluit)? Completed { get; private set; }
+
+    public void Open(RegistrationId registrationId) => _open.Add(new BeoordelingTask($"task-{registrationId}", registrationId));
+
+    public Task<IReadOnlyList<BeoordelingTask>> GetOpenBeoordelingenAsync(CancellationToken ct = default)
+        => Task.FromResult<IReadOnlyList<BeoordelingTask>>(_open);
+
+    public Task ClaimAsync(string taskId, string behandelaar, CancellationToken ct = default) => Task.CompletedTask;
+
+    public Task CompleteBeoordelingAsync(string taskId, BeoordelingsBesluit besluit, CancellationToken ct = default)
+    {
+        Completed = (taskId, besluit);
+        _open.RemoveAll(t => t.TaskId == taskId);
+        return Task.CompletedTask;
+    }
+}
+
 /// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
 public sealed class InMemoryRegistrationStore : IRegistrationStore
 {