feat(zgw): real per-request identity seam + citizen-scoping (WP-53)

Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -103,7 +103,7 @@ for its existing violations, so every WP ends green.
 | [WP-50](WP-50-openzaak-create-zaak.md)                 | OpenZaak create-zaak (first write slice)                                           | 9 · OpenZaak/ZGW            | done   |
 | [WP-51](WP-51-openzaak-documenten.md)                  | OpenZaak Documenten (DRC) upload + zaak link                                       | 9 · OpenZaak/ZGW            | done   |
 | [WP-52](WP-52-openzaak-notificaties.md)                | OpenZaak Notificaties (NRC) live status via webhook                                | 9 · OpenZaak/ZGW            | done   |
-| [WP-53](WP-53-inbound-identity-and-citizen-scoping.md) | Inbound identity seam + citizen-scoping (per-request BSN, ZGW audit claims)        | 9 · OpenZaak/ZGW            | todo   |
+| [WP-53](WP-53-inbound-identity-and-citizen-scoping.md) | Inbound identity seam + citizen-scoping (per-request BSN, ZGW audit claims)        | 9 · OpenZaak/ZGW            | done   |
 | [WP-54](WP-54-openzaak-integration-harness.md)         | Docker OpenZaak integration-test harness (opt-in, live round-trip)                 | 9 · OpenZaak/ZGW            | todo   |
 
 Sequencing dependencies (stated in the WPs too): 01 before 10–15 (axe covers story churn);

docs/project/backlog/WP-53-inbound-identity-and-citizen-scoping.md

@@ -1,6 +1,6 @@
 # WP-53 — Inbound identity + citizen-scoping (the ZGW auth seam)
 
-Status: todo
+Status: done
 Phase: 9 — OpenZaak / ZGW integration
 
 ## Why
@@ -94,16 +94,18 @@ param `rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn=<bsn>` on `GET {Z
 
 ## Acceptance criteria
 
-- [ ] No `DocumentStore.DemoOwner` reference remains in request handling (grep clean); ownership
+- [x] No `DocumentStore.DemoOwner` reference remains in request handling (grep clean); ownership
       comes from the resolved identity.
-- [ ] ZGW JWT carries the acting citizen's `user_id`/`user_representation` (test-verified).
-- [ ] A citizen read returns only that BSN's zaken (local + ZGW-stub tests); admin read unchanged.
-- [ ] `dotnet test` green; `npm run ci` green with **no api-client drift** (FE contract intact).
+- [x] ZGW JWT carries the acting citizen's `user_id`/`user_representation` (test-verified).
+- [x] A citizen read returns only that BSN's zaken (local + ZGW-stub tests); admin read unchanged.
+- [x] `dotnet test` green; `npm run ci` green with **no api-client drift** (FE contract intact).
 
 ## Verification
 
-`cd backend && dotnet test`; manual: `X-Role`/`X-Subject` (or `?role=`) still switches identity
-offline; with `Zgw:Enabled=true` (WP-54 harness) a citizen sees only their zaken.
+`cd backend && dotnet test` (159/159, incl. 8 new); `dotnet format --verify-no-changes` clean;
+`npm run ci` green (no api-client drift). Manual: `X-Role`/`X-Subject` still switch identity
+offline (no header → the seeded citizen, drafter); with `Zgw:Enabled=true` (WP-54 harness) a
+citizen would see only their zaken via the new `rol__…__inpBsn` filter.
 
 ## Out of scope
 
@@ -112,6 +114,27 @@ session sync (CLAUDE.md out-of-scope list).
 
 ## Risks
 
-- Missing a `DemoOwner` call site → a citizen sees another's data. Mitigate: grep gate in the
-  acceptance criteria + a test that two identities don't see each other's cases.
-- ZGW rol filter param name is exact and version-sensitive; assert it in the stub-handler test.
+- Missing a `DemoOwner` call site → a citizen sees another's data. Mitigated: grep gate (clean)
+  + `ApplicationTests.Applications_are_scoped_to_the_caller_bsn` (two `X-Subject` identities,
+  HTTP end-to-end) proving neither sees the other's cases.
+- ZGW rol filter param name is exact and version-sensitive; asserted in
+  `OpenZaakZaakSourceTests.ListMyCases_filters_by_the_callers_bsn`.
+
+## Session notes
+
+Built as designed — no premise in the Decisions/Context block turned out stale. One
+implementation choice not spelled out in the WP: `Authz.ResolvePrincipal(HttpContext ctx)` kept
+its exact signature (now `new(ctx.Caller().Role)` instead of re-reading `X-Role` itself), so
+none of its ~15 call sites needed touching — "flow it to Authz.ResolvePrincipal" didn't require
+threading `CallerIdentity` through every endpoint that resolves a `Principal`. `ZgwTokenProvider`
+grew a `Mint(CallerIdentity)` overload alongside the existing parameterless `Mint()` (kept for
+calls not tied to one citizen — the admin cross-owner `ListCases`, and Catalogi metadata lookups)
+rather than replacing it outright, so `ZgwOptions.UserId`/`UserRepresentation` stay meaningful as
+the BFF's own system identity. `IZaakSource`/`IDocumentSource` gained an explicit `CallerIdentity`
+parameter on every citizen-scoped method (`ListMyCases`, `CreateZaak`, `Upload`, `LinkToZaak`)
+rather than resolving it ambiently via `IHttpContextAccessor` — kept it unit-testable without any
+DI/HttpContext ceremony (see `StubIdentityProviderTests`, the `ZgwTokenProviderTests` addition).
+`GET /applications` (the citizen's own dashboard list) is now routed through
+`IZaakSource.ListMyCases` instead of calling `ApplicationStore` directly — closing the exact gap
+`openzaak-integration.md`'s ACL caveat used to flag for that endpoint; under `Zgw:Enabled=true` it
+would now source from OpenZaak (BSN-filtered) like `/admin/cases` already did.