feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/behandelportal/src/app/behandeling/domain/beoordeling-view.spec.ts

@@ -0,0 +1,58 @@
+import { describe, it, expect } from 'vitest';
+import { statusLabel, detailRows, TYPE_LABELS } from './beoordeling-view';
+import { BeoordelingView } from './beoordeling';
+
+const base: Omit<BeoordelingView, 'status'> = {
+  id: '1',
+  type: 'herregistratie',
+  owner: '*****2333',
+  submittedAt: '2024-05-12',
+  documenten: [],
+  canBesluiten: true,
+};
+
+describe('statusLabel', () => {
+  it('labels every tag distinctly', () => {
+    const labels = [
+      statusLabel({ tag: 'Ingediend', referentie: 'R1' }),
+      statusLabel({ tag: 'InBehandeling', referentie: 'R1', manual: false }),
+      statusLabel({ tag: 'InBehandeling', referentie: 'R1', manual: true }),
+      statusLabel({ tag: 'MeerInfoGevraagd', referentie: 'R1', reden: 'x' }),
+      statusLabel({ tag: 'Goedgekeurd', referentie: 'R1' }),
+      statusLabel({ tag: 'Afgewezen', referentie: 'R1', reden: 'x' }),
+    ];
+    expect(new Set(labels).size).toBe(labels.length);
+  });
+});
+
+describe('detailRows', () => {
+  it('lists soort/status/referentie/eigenaar/ingediend', () => {
+    const rows = detailRows({
+      ...base,
+      status: { tag: 'InBehandeling', referentie: 'R1', manual: false },
+    });
+    const values = rows.map((r) => r.value);
+    expect(values).toContain(TYPE_LABELS.herregistratie);
+    expect(values).toContain('R1');
+    expect(values).toContain(base.owner);
+    expect(rows.length).toBe(5);
+  });
+
+  it('adds a reden row for Afgewezen and MeerInfoGevraagd only', () => {
+    const afgewezen = detailRows({
+      ...base,
+      status: { tag: 'Afgewezen', referentie: 'R1', reden: 'Onvoldoende uren' },
+    });
+    expect(afgewezen.length).toBe(6);
+    expect(afgewezen.map((r) => r.value)).toContain('Onvoldoende uren');
+
+    const meerInfo = detailRows({
+      ...base,
+      status: { tag: 'MeerInfoGevraagd', referentie: 'R1', reden: 'Diploma ontbreekt' },
+    });
+    expect(meerInfo.length).toBe(6);
+
+    const goedgekeurd = detailRows({ ...base, status: { tag: 'Goedgekeurd', referentie: 'R1' } });
+    expect(goedgekeurd.length).toBe(5);
+  });
+});