Mijn aanvragen (A): backend Aanvraag store + lifecycle endpoints

Adds the backend-owned Aanvraag aggregate (PRD 0001, phase A) — the system of
record the dashboard will read. In-memory static store mirroring DocumentStore.

- ApplicationStore: create/get/list/draft-sync/cancel/submit; status COMPUTED ON
  READ (Mappers.ToStatusDto(now)) so auto-approval is pure timestamp arithmetic,
  no timers/jobs (ProcessingWindow = 8s).
- Endpoints: GET /applications, GET/POST/PUT/DELETE /applications/{id},
  POST /applications/{id}/submit.
- Lifecycle: registratie duo -> auto (Goedgekeurd after window), handmatig ->
  manual pending (no 422); herregistratie/intake 0 uren -> Afgewezen else auto.
  Cancel blocks submitted aanvragen (409, no withdrawal in scope).
- Old /registrations endpoint + RejectRegistratie 422 left intact (retire in E).
- ApplicationTests: lifecycle + auto-approve window boundary (pure). 54/54 green.

Also checks in the PRD (docs/prd/0001).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -146,6 +146,85 @@ api.MapDelete("/admin/uploads/{documentId}", (string documentId, HttpContext ctx
 .Produces(StatusCodes.Status403Forbidden)
 .Produces(StatusCodes.Status404NotFound);
 
+// --- Applications (aanvragen): the system of record the dashboard reads. ---
+
+api.MapGet("/applications", () =>
+{
+    var now = DateTimeOffset.UtcNow;
+    return ApplicationStore.List(DocumentStore.DemoOwner)
+        .OrderByDescending(a => a.UpdatedAt)
+        .Select(a => a.ToSummaryDto(now)).ToList();
+});
+
+api.MapGet("/applications/{id}", (string id) =>
+    ApplicationStore.Get(id, DocumentStore.DemoOwner) is { } a
+        ? Results.Ok(a.ToDetailDto(DateTimeOffset.UtcNow))
+        : Results.NotFound())
+.Produces<ApplicationDetailDto>()
+.Produces(StatusCodes.Status404NotFound);
+
+api.MapPost("/applications", (CreateApplicationRequest req) =>
+{
+    var a = ApplicationStore.Create(req.Type, DocumentStore.DemoOwner);
+    return Results.Created($"/api/v1/applications/{a.Id}", a.ToDetailDto(DateTimeOffset.UtcNow));
+})
+.Produces<ApplicationDetailDto>(StatusCodes.Status201Created);
+
+// Draft sync per step — idempotent; keep it debounced on the client (it is chatty).
+api.MapPut("/applications/{id}", (string id, DraftSyncRequest req) =>
+    ApplicationStore.SyncDraft(id, DocumentStore.DemoOwner, req.Draft, req.StepIndex, req.StepCount, req.DocumentIds)
+        ? Results.NoContent() : Results.NotFound())
+.Produces(StatusCodes.Status204NoContent)
+.Produces(StatusCodes.Status404NotFound);
+
+// Cancel a Concept (cascades to its unlinked documents). Submitted aanvragen cannot
+// be withdrawn (out of scope — no "intrekken").
+api.MapDelete("/applications/{id}", (string id) =>
+{
+    var a = ApplicationStore.Get(id, DocumentStore.DemoOwner);
+    if (a is null) return Results.NotFound();
+    if (a.Submitted)
+        return Results.Problem(detail: "Een ingediende aanvraag kan niet worden geannuleerd.", statusCode: StatusCodes.Status409Conflict);
+    ApplicationStore.Delete(id, DocumentStore.DemoOwner);
+    return Results.NoContent();
+})
+.Produces(StatusCodes.Status204NoContent)
+.ProducesProblem(StatusCodes.Status409Conflict)
+.Produces(StatusCodes.Status404NotFound);
+
+// Submit runs the server-owned rules, sets autoApprovable, and transitions the
+// aanvraag. handmatig no longer 422s (ADR-0002): it becomes a manual (pending) case.
+api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest req, HttpContext ctx) =>
+{
+    var existing = ApplicationStore.Get(id, DocumentStore.DemoOwner);
+    if (existing is null) return Results.NotFound();
+    if (existing.Submitted)
+        return Results.Problem(detail: "Aanvraag is al ingediend.", statusCode: StatusCodes.Status409Conflict);
+
+    // Per wizard type: what rejects the submission (→ Afgewezen) and whether it auto-approves.
+    (string? reject, bool autoApprovable) = existing.Type switch
+    {
+        "registratie" => (null, req.DiplomaHerkomst == "duo"),
+        _ /* herregistratie | intake */ => (SubmissionRules.RejectZeroUren(req.Uren ?? 0), true),
+    };
+
+    var docs = req.Documents;
+    if (docs is not null)
+        DocumentStore.Link(docs.Where(d => d.Channel == "digital" && d.DocumentId is not null).Select(d => d.DocumentId!));
+    var documentIds = docs?.Where(d => d.DocumentId is not null).Select(d => d.DocumentId!).ToList();
+
+    var submitted = ApplicationStore.Submit(id, DocumentStore.DemoOwner, reject, autoApprovable, documentIds);
+    if (submitted is null) return Results.Conflict();
+
+    app.Logger.LogInformation(
+        "aanvraag submit id={Id} type={Type} outcome={Outcome} auto={Auto} reference={Reference}",
+        id, existing.Type, reject is null ? "accepted" : "rejected", autoApprovable, submitted.Referentie);
+    return Results.Ok(new SubmitApplicationResponse(submitted.Referentie!, submitted.ToStatusDto(DateTimeOffset.UtcNow)));
+})
+.Produces<SubmitApplicationResponse>()
+.ProducesProblem(StatusCodes.Status409Conflict)
+.Produces(StatusCodes.Status404NotFound);
+
 app.Run();
 
 static bool IsAdmin(HttpContext ctx) => ctx.Request.Headers["X-Admin"] == "true";