feat(behandelportal): WP-65a beoordeling detail (read) + fix unreachable medewerker login

New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.

Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.

WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

libs/shared/src/infrastructure/api-client.ts

@@ -1116,6 +1116,55 @@ export class ApiClient {
         return Promise.resolve<ApplicationSummaryDto[]>(null as any);
     }
 
+    /**
+     * @return OK
+     */
+    beoordeling(id: string): Promise<BeoordelingViewDto> {
+        let url_ = this.baseUrl + "/api/v1/beoordeling/{id}";
+        if (id === undefined || id === null)
+            throw new globalThis.Error("The parameter 'id' must be defined.");
+        url_ = url_.replace("{id}", encodeURIComponent("" + id));
+        url_ = url_.replace(/[?&]$/, "");
+
+        let options_: RequestInit = {
+            method: "GET",
+            headers: {
+                "Accept": "application/json"
+            }
+        };
+
+        return this.http.fetch(url_, options_).then((_response: Response) => {
+            return this.processBeoordeling(_response);
+        });
+    }
+
+    protected processBeoordeling(response: Response): Promise<BeoordelingViewDto> {
+        const status = response.status;
+        let _headers: any = {}; if (response.headers && response.headers.forEach) { response.headers.forEach((v: any, k: any) => _headers[k] = v); };
+        if (status === 200) {
+            return response.text().then((_responseText) => {
+            let result200: any = null;
+            result200 = _responseText === "" ? null : JSON.parse(_responseText, this.jsonParseReviver) as BeoordelingViewDto;
+            return result200;
+            });
+        } else if (status === 403) {
+            return response.text().then((_responseText) => {
+            let result403: any = null;
+            result403 = _responseText === "" ? null : JSON.parse(_responseText, this.jsonParseReviver) as ProblemDetails;
+            return throwException("Forbidden", status, _responseText, _headers, result403);
+            });
+        } else if (status === 404) {
+            return response.text().then((_responseText) => {
+            return throwException("Not Found", status, _responseText, _headers);
+            });
+        } else if (status !== 200 && status !== 204) {
+            return response.text().then((_responseText) => {
+            return throwException("An unexpected server error occurred.", status, _responseText, _headers);
+            });
+        }
+        return Promise.resolve<BeoordelingViewDto>(null as any);
+    }
+
     /**
      * @return No Content
      */
@@ -1944,6 +1993,22 @@ export interface AuthzAuditDto {
     correlationId?: string | undefined;
 }
 
+export interface BeoordelingDecisionsDto {
+    canBesluiten?: boolean;
+}
+
+export interface BeoordelingDocumentDto {
+    documentId?: string | undefined;
+    categoryId?: string | undefined;
+    fileName?: string | undefined;
+}
+
+export interface BeoordelingViewDto {
+    aanvraag?: ApplicationSummaryDto;
+    documenten?: BeoordelingDocumentDto[] | undefined;
+    decisions?: BeoordelingDecisionsDto;
+}
+
 export interface BriefDecisionsDto {
     canEdit?: boolean;
     canApprove?: boolean;