fix(uploads): authorize the document-content and status endpoints (RB-01)

GET /uploads/{documentId}/content took only (string documentId) — no
HttpContext, so no authorization was possible. It streams diploma and
identity scans, protected by GUID unguessability alone, while DELETE on the
same resource has always been owner-scoped. GET /uploads/status had the same
shape and confirmed whether any client-chosen localId exists, plus its
documentId.

Both now take HttpContext. Content is readable by the owning
ZorgverlenerCaller or a caller passing Authz.CanBeoordelen — matched on the
caller kind rather than branched on a boolean, because ctx.Zorgverlener()
throws for a MedewerkerCaller and the behandelportal's beoordeling screen is
a legitimate reader. Status is scoped to ctx.Zorgverlener().Bsn via a new
owner parameter on DocumentStore.ByLocalIds (one call site).

404, not 403, on both: a foreign document id must not be distinguishable
from one that never existed, and a foreign localId reads back as "unknown".

Residual, recorded in the implementation note: both callers reach the URL as
a plain browser navigation (<a href> / previewUrl), which carries no identity
header and no interceptor, so StubIdentityProvider resolves it to the seeded
citizen. That is BIO-002 and belongs to RB-09; the links keep working today
only because one citizen owns every document in the POC.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -73,13 +73,13 @@ public static class DocumentStore
 
   /// Status for the poll-on-return pattern: a known localId is "complete" (it
   /// arrived), an unknown one is still in flight / never started.
-  public static IReadOnlyList<StoredDocument> ByLocalIds(IEnumerable<string> localIds)
+  public static IReadOnlyList<StoredDocument> ByLocalIds(IEnumerable<string> localIds, string owner)
   {
     var set = localIds.ToHashSet();
     lock (_gate)
     {
       using var db = Db.Create();
-      return db.Documents.Where(d => set.Contains(d.LocalId)).ToList();
+      return db.Documents.Where(d => set.Contains(d.LocalId) && d.Owner == owner).ToList();
     }
   }