feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Domain/Authorization/StubIdentityProvider.cs

@@ -0,0 +1,32 @@
+using BigRegister.Api.Data;
+
+namespace BigRegister.Domain.Authorization;
+
+/// <summary>
+/// Dev stub (WP-53) — NOT a security boundary, same caveat as <see cref="Authz.ResolvePrincipal"/>
+/// (which this provider now backs). Role comes from the existing client-asserted X-Role header
+/// (mirrors the FE's <c>?role=</c> toggle); the subject BSN comes from a new X-Subject header,
+/// defaulting to the single seeded citizen (<see cref="DocumentStore.DemoOwner"/>) so every
+/// existing request — none of which send X-Subject — keeps behaving exactly as before this WP.
+/// A real system builds this from verified AD/OIDC/DigiD claims; every consumer of
+/// <see cref="CallerIdentity"/> carries over unchanged once that swap happens.
+/// </summary>
+public sealed class StubIdentityProvider : IIdentityProvider
+{
+  public CallerIdentity Resolve(HttpContext ctx)
+  {
+    var role = ctx.Request.Headers["X-Role"].ToString() switch
+    {
+      "approver" => PrincipalRole.Approver,
+      "admin" => PrincipalRole.Admin,
+      _ => PrincipalRole.Drafter,
+    };
+    var bsn = ctx.Request.Headers.TryGetValue("X-Subject", out var v) && !string.IsNullOrEmpty(v)
+        ? v.ToString()
+        : DocumentStore.DemoOwner;
+    // Only one seeded citizen exists in this POC — a real provider carries the display name in
+    // the verified claims themselves, so there's no "look up a name by BSN" step to stand in for.
+    var displayName = bsn == DocumentStore.DemoOwner ? SeedData.Registration.Naam : bsn;
+    return new CallerIdentity(bsn, displayName, role);
+  }
+}