feat(registratie): WP-36 — admin cases page + admin delete

Admin-only overview of all cases across owners + an admin delete, gated by a new
`cases:manage` capability (Authz role→cap + CanManageCases + CasesAdmin gate;
FE capability + guard + nav + role.interceptor prefix — the org-template/stamdata
recipe). Backend adds ApplicationStore.ListAll()/DeleteAny() and GET /admin/cases +
DELETE /admin/cases/{id}; admin delete removes ANY case incl. submitted. Page lives
in registratie/ui (owns the Aanvraag aggregate; reuses aanvraag-view + parse),
routed /beheer/zaken; delete guarded by a native confirm, optimistic with rollback.
Typed client regenerated (documents the new endpoints + owner field).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -96,7 +96,8 @@ public sealed record AanvraagStatusDto(
 public sealed record ApplicationSummaryDto(
     string Id, string Type, AanvraagStatusDto Status,
     IReadOnlyList<string> DocumentIds,
-    string CreatedAt, string UpdatedAt, string? SubmittedAt);
+    string CreatedAt, string UpdatedAt, string? SubmittedAt,
+    string? Owner = null);   // populated for the admin cross-owner list (WP-36); the user's own list ignores it
 
 public sealed record ApplicationDetailDto(
     string Id, string Type, AanvraagStatusDto Status,

backend/src/BigRegister.Api/Contracts/Mappers.cs

@@ -55,6 +55,10 @@ public static class Mappers
       a.Id, a.Type, a.ToStatusDto(now), a.DocumentIds,
       a.CreatedAt.ToString("o"), a.UpdatedAt.ToString("o"), a.SubmittedAt?.ToString("o"));
 
+  /// Admin summary — same shape plus the owner (WP-36; the user-facing list leaves Owner null).
+  public static ApplicationSummaryDto ToAdminSummaryDto(this Aanvraag a, DateTimeOffset now) =>
+      a.ToSummaryDto(now) with { Owner = a.Owner };
+
   public static ApplicationDetailDto ToDetailDto(this Aanvraag a, DateTimeOffset now) => new(
       a.Id, a.Type, a.ToStatusDto(now), a.Draft, a.DocumentIds,
       a.CreatedAt.ToString("o"), a.UpdatedAt.ToString("o"), a.SubmittedAt?.ToString("o"));

backend/src/BigRegister.Api/Data/ApplicationStore.cs

@@ -80,6 +80,19 @@ public static class ApplicationStore
     }
   }
 
+  /// Admin: every case across all owners (WP-36). The per-owner List is the norm; this
+  /// is the deliberate cross-owner read behind the admin-only /admin/cases endpoint.
+  public static IReadOnlyList<Aanvraag> ListAll()
+  {
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      // Order client-side: SQLite can't ORDER BY a DateTimeOffset (same constraint the
+      // rest of the store sidesteps by never sorting in the query).
+      return db.Applications.ToList().OrderByDescending(a => a.UpdatedAt).ToList();
+    }
+  }
+
   /// Draft sync: idempotent upsert of the wizard snapshot. Only a Concept is mutable.
   public static bool SyncDraft(string id, string owner, JsonElement draft, int stepIndex, int stepCount, IReadOnlyList<string>? documentIds)
   {
@@ -116,6 +129,28 @@ public static class ApplicationStore
     return true;
   }
 
+  /// Admin: delete ANY case regardless of owner or submitted state (WP-36). The
+  /// user-facing Delete refuses a submitted aanvraag and is owner-scoped; an admin
+  /// managing the register may remove any case. Cascades to the case's documents
+  /// using its own owner. Returns false only when the id doesn't exist.
+  public static bool DeleteAny(string id)
+  {
+    string owner;
+    List<string> docs;
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      var a = db.Applications.Find(id);
+      if (a is null) return false;
+      owner = a.Owner;
+      docs = a.DocumentIds.ToList();
+      db.Applications.Remove(a);
+      db.SaveChanges();
+    }
+    foreach (var d in docs) DocumentStore.DeleteOwned(d, owner);
+    return true;
+  }
+
   /// Submit transition. reject != null → Afgewezen; else accepted (In behandeling,
   /// auto-advancing to Goedgekeurd after the window when autoApprovable). Returns null
   /// if the aanvraag is gone or already submitted (idempotency guard).

backend/src/BigRegister.Api/Domain/Authorization/Authz.cs

@@ -43,7 +43,7 @@ public static class Authz
   public static IReadOnlyList<string> RoleCapabilities(Principal principal) => principal.Role switch
   {
     PrincipalRole.Approver => new[] { "brief:approve", "brief:reject", "brief:send" },
-    PrincipalRole.Admin => new[] { "orgtemplate:edit", "stamdata:edit" },
+    PrincipalRole.Admin => new[] { "orgtemplate:edit", "stamdata:edit", "cases:manage" },
     _ => Array.Empty<string>(),
   };
 
@@ -69,6 +69,11 @@ public static class Authz
   /// the maintenance editor consumes; the actual edit lands as a reviewed PR, not a write here.
   public static bool CanEditStamdata(Principal principal) => principal.Role == PrincipalRole.Admin;
 
+  /// Case management (WP-36): admin-only, resource-independent — same shape as
+  /// org-template / stamdata (role IS the decision). Gates the cross-owner /admin/cases
+  /// list + admin delete.
+  public static bool CanManageCases(Principal principal) => principal.Role == PrincipalRole.Admin;
+
   /// Field-level PII (PRD-0002 §5c, phase P2): the case screen's BIG-nummer ships
   /// masked by default; only the behandelaar (Drafter) composing the case — the actor
   /// whose behandel-scherm shows the field — may reveal it. Role-based in the POC; a

backend/src/BigRegister.Api/Program.cs

@@ -309,6 +309,27 @@ api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest re
 .ProducesProblem(StatusCodes.Status409Conflict)
 .Produces(StatusCodes.Status404NotFound);
 
+// --- Admin cases (WP-36): cross-owner list + admin delete, gated by `cases:manage`. ---
+api.MapGet("/admin/cases", (HttpContext ctx) => CasesAdmin(ctx, () =>
+{
+  var now = DateTimeOffset.UtcNow;
+  return Results.Ok(ApplicationStore.ListAll().Select(a => a.ToAdminSummaryDto(now)).ToList());
+}))
+.Produces<List<ApplicationSummaryDto>>()
+.ProducesProblem(StatusCodes.Status403Forbidden);
+
+// Admin delete removes ANY case (any owner, submitted or not) — unlike the user-facing
+// DELETE /applications/{id}. A missing id is a 404.
+api.MapDelete("/admin/cases/{id}", (string id, HttpContext ctx) => CasesAdmin(ctx, () =>
+{
+  if (!ApplicationStore.DeleteAny(id)) return Results.NotFound();
+  app.Logger.LogInformation("admin case delete id={Id}", id);
+  return Results.NoContent();
+}))
+.Produces(StatusCodes.Status204NoContent)
+.Produces(StatusCodes.Status404NotFound)
+.ProducesProblem(StatusCodes.Status403Forbidden);
+
 // PRD-0002 §6: coarse, role-derived capabilities for nav/menu-level checks (NOT
 // tied to a specific brief's live status — see BriefDecisionsDto for that).
 api.MapGet("/me", (HttpContext ctx) => new MeDto(Authz.RoleCapabilities(Authz.ResolvePrincipal(ctx))))
@@ -515,6 +536,17 @@ IResult StamdataAdmin(HttpContext ctx, Func<IResult> action)
       statusCode: StatusCodes.Status403Forbidden);
 }
 
+// One gate for every admin-cases endpoint — the enforce twin of the `cases:manage`
+// capability RoleCapabilities emits (single Authz source, WP-36). A denial is audited.
+IResult CasesAdmin(HttpContext ctx, Func<IResult> action)
+{
+  var principal = Authz.ResolvePrincipal(ctx);
+  if (Authz.CanManageCases(principal)) return action();
+  AuditAuthz(ctx, "cases:manage", "cases", false, principal);
+  return Results.Problem(detail: "Alleen een beheerder mag aanvragen beheren.",
+      statusCode: StatusCodes.Status403Forbidden);
+}
+
 static StamdataColumnDto ToColumnDto(StamdataColumn c) => new(c.Name, c.Type, c.IsKey, c.Options);
 
 // Authorization audit (PRD-0002 §8): access-relevant decisions recorded with NO PII —