feat(fp): WP-23 — org-template backend + admin role

Second template axis (org identity: letterhead, footer, signature,
margins) server-side: OrgTemplateStore with JSON version history,
publish/rollback, sent-brief version pinning, admin role + capability,
5 admin endpoints, org-logo upload category. FE seam widened only
(Role/Capability unions, interceptor); WP-24/26 consume it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Domain/Authorization/Authz.cs

@@ -3,7 +3,7 @@ using BigRegister.Api.Data;
 
 namespace BigRegister.Domain.Authorization;
 
-public enum PrincipalRole { Drafter, Approver }
+public enum PrincipalRole { Drafter, Approver, Admin }
 
 /// <summary>
 /// The acting identity for this request. dev stub — NOT a security boundary: resolved
@@ -24,30 +24,46 @@ public enum BriefAction { Approve, Reject, Send }
 /// </summary>
 public static class Authz
 {
-  public static Principal ResolvePrincipal(HttpContext ctx) =>
-      new(ctx.Request.Headers["X-Role"].ToString() == "approver" ? PrincipalRole.Approver : PrincipalRole.Drafter);
+  public static Principal ResolvePrincipal(HttpContext ctx) => new(ctx.Request.Headers["X-Role"].ToString() switch
+  {
+    "approver" => PrincipalRole.Approver,
+    "admin" => PrincipalRole.Admin,
+    _ => PrincipalRole.Drafter,
+  });
 
-  public static string ActingId(Principal principal) =>
-      principal.Role == PrincipalRole.Approver ? BriefStore.ApproverId : BriefStore.DrafterId;
+  public static string ActingId(Principal principal) => principal.Role switch
+  {
+    PrincipalRole.Approver => BriefStore.ApproverId,
+    PrincipalRole.Admin => BriefStore.AdminId,
+    _ => BriefStore.DrafterId,
+  };
 
   /// Coarse, resource-independent capabilities for `GET /me` (nav/menu-level — NOT
   /// tied to any specific brief's live status; contrast Decisions below).
-  public static IReadOnlyList<string> RoleCapabilities(Principal principal) =>
-      principal.Role == PrincipalRole.Approver
-          ? new[] { "brief:approve", "brief:reject", "brief:send" }
-          : Array.Empty<string>();
+  public static IReadOnlyList<string> RoleCapabilities(Principal principal) => principal.Role switch
+  {
+    PrincipalRole.Approver => new[] { "brief:approve", "brief:reject", "brief:send" },
+    PrincipalRole.Admin => new[] { "orgtemplate:edit" },
+    _ => Array.Empty<string>(),
+  };
 
   /// Role + four-eyes (SoD) check only — no status. This is the exact check
   /// BriefStore.Review enforces before its status guard; kept separate from
   /// Decisions() below so enforcement ORDER (Forbidden before Conflict) matches
-  /// today's behavior exactly.
+  /// today's behavior exactly. The explicit Approver condition keeps the new Admin
+  /// role out of the review flow (WP-23) — SoD alone would have let it through.
   public static bool CanActOn(BriefAction action, Principal principal, string drafterId) => action switch
   {
-    BriefAction.Approve or BriefAction.Reject => ActingId(principal) != drafterId,
+    BriefAction.Approve or BriefAction.Reject =>
+        principal.Role == PrincipalRole.Approver && ActingId(principal) != drafterId,
     BriefAction.Send => true, // sending is a mechanical dispatch step, not role-gated today
     _ => false,
   };
 
+  /// Org-template management (WP-23): admin-only, resource-independent — templates
+  /// have no per-resource state to weigh, so role IS the whole decision here.
+  public static bool CanManageOrgTemplates(Principal principal) => principal.Role == PrincipalRole.Admin;
+
   /// Resource-aware decision for the screen DTO: "would this action succeed right
   /// now" — role/SoD AND the brief's current status. This is what the UI renders;
   /// it never re-derives these booleans itself.

backend/src/BigRegister.Api/Domain/Documents/DocumentCategory.cs

@@ -19,6 +19,7 @@ public static class DocumentRules
 {
   private static readonly string[] Pdf = { "application/pdf" };
   private static readonly string[] PdfImage = { "application/pdf", "image/jpeg", "image/png" };
+  private static readonly string[] Image = { "image/jpeg", "image/png" };
 
   private static readonly DocumentCategory Diploma = new("diploma", "Diplomabewijs",
       "Upload uw diploma als PDF-bestand.", true, Pdf, 10, false, false);
@@ -42,6 +43,13 @@ public static class DocumentRules
             new DocumentCategory("nascholing", "Nascholingscertificaten",
                 "Upload uw nascholingscertificaten (optioneel).", false, PdfImage, 10, true, true),
         },
+    // WP-23: the admin's org-template logo rides the same upload machinery as the
+    // wizard documents — one category under its own "wizard" id.
+    "org-template" => new[]
+    {
+            new DocumentCategory("org-logo", "Organisatielogo",
+                "Upload het logo van de organisatie (PNG of JPG).", false, Image, 1, false, false),
+        },
     _ => Array.Empty<DocumentCategory>(),
   };
 

backend/src/BigRegister.Api/Domain/Letters/OrgTemplateRules.cs

@@ -0,0 +1,28 @@
+using BigRegister.Api.Contracts;
+
+namespace BigRegister.Domain.Letters;
+
+/// <summary>
+/// SERVER-OWNED org-template validation (Brief v2 PRD §5): bounded margins so an
+/// admin cannot break the letter geometry, and the identity fields a letter cannot
+/// render without. The FE mirrors the bounds for instant feedback (config values on
+/// the wire if ever needed); this is the authority.
+/// </summary>
+public static class OrgTemplateRules
+{
+  public const int MarginMinMm = 10;
+  public const int MarginMaxMm = 50;
+
+  /// Returns a rejection reason, or null when the draft is acceptable.
+  public static string? RejectDraft(OrgTemplateDto draft)
+  {
+    if (string.IsNullOrWhiteSpace(draft.OrgName)) return "Organisatienaam is verplicht.";
+    if (string.IsNullOrWhiteSpace(draft.SignatureName)) return "Naam van de ondertekenaar is verplicht.";
+    var m = draft.Margins;
+    var outOfBounds = new[] { m.TopMm, m.RightMm, m.BottomMm, m.LeftMm }
+        .Any(v => v is < MarginMinMm or > MarginMaxMm);
+    return outOfBounds
+        ? $"Marges moeten tussen {MarginMinMm} en {MarginMaxMm} mm liggen."
+        : null;
+  }
+}