Upload feature (a): BFF endpoints + category config + tests

- Domain/Documents: server-owned category config per wizard + authoritative
  type/size validation (DocumentRules).
- Data/DocumentStore: in-memory metadata store (no file bytes/PII) + audit log;
  user delete (owner-scoped, 409 once linked), admin delete (role seam via
  X-Admin header), link-on-submit, poll-by-localId status.
- Program.cs: GET /uploads/categories, POST /uploads (multipart, excluded from
  OpenAPI — hand-written on FE), GET /uploads/status, DELETE /uploads/{id},
  DELETE /admin/uploads/{id}. Submit links digital docs + records post-delivery.
- Contracts extended (DocumentRefDto on registratie/herregistratie submit);
  regenerated NSwag client + swagger.json (drift check stays green).
- Tests: 16 new (endpoints + DocumentRules); dotnet test 44/44.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/EndpointTests.cs

@@ -1,6 +1,8 @@
 using System.Net;
+using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using BigRegister.Api.Contracts;
+using BigRegister.Api.Data;
 using Microsoft.AspNetCore.Mvc.Testing;
 
 namespace BigRegister.Tests;
@@ -122,4 +124,89 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
         var res = await _client.GetAsync("/health");
         res.EnsureSuccessStatusCode();
     }
+
+    // --- Document upload ---
+
+    private static MultipartFormDataContent UploadForm(string localId, string categoryId, string wizardId, string fileName, string contentType)
+    {
+        var content = new MultipartFormDataContent();
+        var file = new ByteArrayContent(new byte[] { 1, 2, 3 });
+        file.Headers.ContentType = new MediaTypeHeaderValue(contentType);
+        content.Add(file, "file", fileName);
+        content.Add(new StringContent(categoryId), "categoryId");
+        content.Add(new StringContent(localId), "localId");
+        content.Add(new StringContent(wizardId), "wizardId");
+        return content;
+    }
+
+    private async Task<UploadResponse> Upload(string localId, string categoryId = "diploma", string type = "application/pdf", string file = "d.pdf")
+    {
+        var res = await _client.PostAsync("/api/v1/uploads", UploadForm(localId, categoryId, "registratie", file, type));
+        Assert.Equal(HttpStatusCode.Created, res.StatusCode);
+        return (await res.Content.ReadFromJsonAsync<UploadResponse>())!;
+    }
+
+    [Fact]
+    public async Task Categories_are_server_owned_config()
+    {
+        var dto = await _client.GetFromJsonAsync<UploadCategoriesDto>("/api/v1/uploads/categories?wizardId=registratie");
+        Assert.Contains(dto!.Categories, c => c.CategoryId == "diploma" && c.Required && !c.AllowPostDelivery);
+        Assert.Contains(dto.Categories, c => c.CategoryId == "identiteit" && c.AllowPostDelivery);
+    }
+
+    [Fact]
+    public async Task Upload_then_status_reports_complete_for_known_localId()
+    {
+        var localId = Guid.NewGuid().ToString();
+        var doc = await Upload(localId);
+        var status = await _client.GetFromJsonAsync<UploadStatusDto>($"/api/v1/uploads/status?localIds={localId},onbekend");
+        Assert.Contains(status!.Results, r => r.LocalId == localId && r.Status == "complete" && r.DocumentId == doc.DocumentId);
+        Assert.Contains(status.Results, r => r.LocalId == "onbekend" && r.Status == "unknown");
+    }
+
+    [Fact]
+    public async Task Upload_rejects_wrong_type()
+    {
+        var res = await _client.PostAsync("/api/v1/uploads",
+            UploadForm(Guid.NewGuid().ToString(), "diploma", "registratie", "d.txt", "text/plain"));
+        Assert.Equal(HttpStatusCode.BadRequest, res.StatusCode);
+    }
+
+    [Fact]
+    public async Task User_delete_succeeds_then_404()
+    {
+        var doc = await Upload(Guid.NewGuid().ToString());
+        Assert.Equal(HttpStatusCode.NoContent, (await _client.DeleteAsync($"/api/v1/uploads/{doc.DocumentId}")).StatusCode);
+        Assert.Equal(HttpStatusCode.NotFound, (await _client.DeleteAsync($"/api/v1/uploads/{doc.DocumentId}")).StatusCode);
+    }
+
+    [Fact]
+    public async Task User_delete_blocked_with_409_once_linked_to_submission()
+    {
+        var doc = await Upload(Guid.NewGuid().ToString());
+        var submit = await _client.PostAsJsonAsync("/api/v1/registrations",
+            new RegistratieRequest("duo", new[] { new DocumentRefDto("diploma", "digital", doc.DocumentId) }));
+        submit.EnsureSuccessStatusCode();
+        Assert.Equal(HttpStatusCode.Conflict, (await _client.DeleteAsync($"/api/v1/uploads/{doc.DocumentId}")).StatusCode);
+    }
+
+    [Fact]
+    public async Task Admin_delete_requires_admin_role()
+    {
+        var doc = await Upload(Guid.NewGuid().ToString());
+        Assert.Equal(HttpStatusCode.Forbidden, (await _client.DeleteAsync($"/api/v1/admin/uploads/{doc.DocumentId}")).StatusCode);
+
+        var req = new HttpRequestMessage(HttpMethod.Delete, $"/api/v1/admin/uploads/{doc.DocumentId}");
+        req.Headers.Add("X-Admin", "true");
+        Assert.Equal(HttpStatusCode.NoContent, (await _client.SendAsync(req)).StatusCode);
+    }
+
+    [Fact]
+    public async Task Audit_log_records_upload_and_delete_metadata_only()
+    {
+        var doc = await Upload(Guid.NewGuid().ToString());
+        await _client.DeleteAsync($"/api/v1/uploads/{doc.DocumentId}");
+        Assert.Contains(DocumentStore.AuditLog, a => a.DocumentId == doc.DocumentId && a.Action == "upload");
+        Assert.Contains(DocumentStore.AuditLog, a => a.DocumentId == doc.DocumentId && a.Action == "delete-user");
+    }
 }