feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -5,6 +5,7 @@ using System.Text.Json.Serialization;
 using BigRegister.Api.Contracts;
 using BigRegister.Api.Data;
 using BigRegister.Domain.Authorization;
+using BigRegister.Domain.Beoordeling;
 using BigRegister.Domain.Diplomas;
 using BigRegister.Domain.Documents;
 using BigRegister.Domain.Features;
@@ -413,13 +414,34 @@ api.MapGet("/admin/cases", (HttpContext ctx, IZaakSource zaken) => CasesAdmin(ct
 // Cross-owner like /admin/cases, but gated by the medewerker capability (`CanBeoordelen`,
 // WP-62) rather than the admin role, and pre-filtered to the two "still open" status tags —
 // a behandelaar never needs to see a Concept (not their business yet) or a terminal case.
-api.MapGet("/werkvoorraad", (HttpContext ctx, IZaakSource zaken) => Werkvoorraad(ctx, () =>
+api.MapGet("/werkvoorraad", (HttpContext ctx, IZaakSource zaken) => Beoordelen(ctx, "werkvoorraad", () =>
     Results.Ok(zaken.ListCases(DateTimeOffset.UtcNow)
         .Where(c => c.Status.Tag is "Ingediend" or "InBehandeling")
         .ToList())))
 .Produces<List<ApplicationSummaryDto>>()
 .ProducesProblem(StatusCodes.Status403Forbidden);
 
+// --- Beoordeling (WP-65): one aanvraag's case-treatment detail — read side only (recording
+// a decision is WP-65's second half). Reads through IZaakSource.ListCases (no new seam method:
+// adding one now would force an OpenZaak get-by-id + mapper, which is WP-66's surface) — O(n)
+// over a POC-sized table. A Concept isn't a case a behandelaar can treat yet, so it 404s here
+// same as an unknown id (only /applications/{id}, citizen-scoped, shows a Concept).
+api.MapGet("/beoordeling/{id}", (string id, HttpContext ctx, IZaakSource zaken) =>
+    Beoordelen(ctx, $"aanvraag/{id}", () =>
+    {
+      var c = zaken.ListCases(DateTimeOffset.UtcNow).FirstOrDefault(x => x.Id == id);
+      if (c is null || c.Status.Tag == "Concept") return Results.NotFound();
+      var docs = DocumentStore.ByIds(c.DocumentIds)
+          .Select(d => new BeoordelingDocumentDto(d.DocumentId, d.CategoryId, d.FileName)).ToList();
+      var masked = c with { Owner = MaskTail(c.Owner!, 3) };
+      var decisions = new BeoordelingDecisionsDto(
+          BeoordelingRules.CanDecide(Enum.Parse<AanvraagStatusTag>(c.Status.Tag)));
+      return Results.Ok(new BeoordelingViewDto(masked, docs, decisions));
+    }))
+.Produces<BeoordelingViewDto>()
+.ProducesProblem(StatusCodes.Status403Forbidden)
+.Produces(StatusCodes.Status404NotFound);
+
 // OpenZaak's Notificaties API (NRC) calls this on every zaak event once an `abonnement` is
 // provisioned (WP-52, out-of-band — see openzaak-integration.md, no app code subscribes it).
 // The caller is NRC, not a user: no Principal, so this audits via AuthzAuditStore directly
@@ -708,14 +730,15 @@ IResult CasesAdmin(HttpContext ctx, Func<IResult> action)
       statusCode: StatusCodes.Status403Forbidden);
 }
 
-// One gate for the werkvoorraad read — the enforce twin of `CanBeoordelen` (WP-62/64).
-// Unlike the other *Admin gates above, this checks the CallerIdentity directly (medewerker
-// rollen), not a role-only Principal — a zorgverlener with X-Role=admin still gets denied.
-IResult Werkvoorraad(HttpContext ctx, Func<IResult> action)
+// One gate for every behandelaar endpoint (werkvoorraad, WP-64; beoordeling detail, WP-65) —
+// the enforce twin of `CanBeoordelen` (WP-62). Unlike the other *Admin gates above, this
+// checks the CallerIdentity directly (medewerker rollen), not a role-only Principal — a
+// zorgverlener with X-Role=admin still gets denied. `resource` feeds the denial's audit row.
+IResult Beoordelen(HttpContext ctx, string resource, Func<IResult> action)
 {
   if (Authz.CanBeoordelen(ctx.Caller())) return action();
-  AuditAuthz(ctx, "aanvraag:beoordelen", "werkvoorraad", false, Authz.ResolvePrincipal(ctx));
-  return Results.Problem(detail: "Alleen een behandelaar mag de werkvoorraad bekijken.",
+  AuditAuthz(ctx, "aanvraag:beoordelen", resource, false, Authz.ResolvePrincipal(ctx));
+  return Results.Problem(detail: "Alleen een behandelaar mag aanvragen beoordelen.",
       statusCode: StatusCodes.Status403Forbidden);
 }