Mijn aanvragen (B): store document bytes + content endpoint

- StoredDocument gains ContentType + byte[] Content; POST /uploads now captures
  the file bytes (in-memory, reset on restart — POC).
- GET /uploads/{documentId}/content streams the bytes: inline for pdf/image
  (browser preview), attachment otherwise (download). 404 for unknown ids
  (covers the demo-* simulation sentinels, which have no bytes).
- Bytes are never serialized into a JSON response; only this endpoint streams them.
- Tests: content served back with type inline for pdf, 404 for unknown. 56/56 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -1,13 +1,14 @@
 namespace BigRegister.Api.Data;
 
 /// <summary>
-/// Stored document metadata. The demo deliberately keeps NO file content — only
-/// metadata — which is enough for status/delete/link and avoids holding PII bytes
-/// in memory. A real backend persists the bytes to blob storage keyed by DocumentId.
+/// Stored document: metadata + bytes. The demo holds bytes IN-MEMORY (reset on
+/// restart) purely so re-opened wizards can preview/download what was uploaded — a
+/// real backend persists them to blob storage keyed by DocumentId. Bytes are never
+/// serialized into a JSON response; only the dedicated content endpoint streams them.
 /// </summary>
 public sealed record StoredDocument(
     string DocumentId, string LocalId, string CategoryId, string WizardId,
-    string FileName, long SizeBytes, string Owner, DateTimeOffset UploadedAt)
+    string FileName, long SizeBytes, string ContentType, byte[] Content, string Owner, DateTimeOffset UploadedAt)
 {
     public bool Linked { get; set; }
 }
@@ -28,9 +29,9 @@ public static class DocumentStore
     private static readonly List<AuditEntry> _audit = new();
     private static readonly object _gate = new();
 
-    public static StoredDocument Add(string localId, string categoryId, string wizardId, string fileName, long sizeBytes, string owner)
+    public static StoredDocument Add(string localId, string categoryId, string wizardId, string fileName, string contentType, byte[] content, string owner)
     {
-        var doc = new StoredDocument(Guid.NewGuid().ToString(), localId, categoryId, wizardId, fileName, sizeBytes, owner, DateTimeOffset.UtcNow);
+        var doc = new StoredDocument(Guid.NewGuid().ToString(), localId, categoryId, wizardId, fileName, content.LongLength, contentType, content, owner, DateTimeOffset.UtcNow);
         lock (_gate) _docs[doc.DocumentId] = doc;
         Audit("upload", doc.DocumentId, categoryId, owner);
         return doc;