test(domain): only a clean PDF diploma is stored and unblocks beoordeling (refs #192)

Red: ProvideDocuments takes the new IDocumentScanner port but ignores it, so
infected, non-PDF and scanner-unavailable uploads are still Accepted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/Fakes.cs

@@ -146,3 +146,14 @@ internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
         return Task.CompletedTask;
     }
 }
+
+internal sealed class FakeDocumentScanner(ScanVerdict verdict = ScanVerdict.Clean) : IDocumentScanner
+{
+    public byte[]? Scanned { get; private set; }
+
+    public Task<ScanVerdict> ScanAsync(byte[] content, CancellationToken ct = default)
+    {
+        Scanned = content;
+        return Task.FromResult(verdict);
+    }
+}