fix(backend): reject foreign documentIds on submit and draft-sync (WP-68 F1)

submit and draft-sync took document ids straight from the request body with no
ownership check: a caller who knew a foreign document's id could attach another
citizen's upload to their own aanvraag (surfacing on the behandelaar's beoordeling
screen, POSTed to OpenZaak as their zaakinformatieobject) and permanently block the
victim's own delete by flipping Linked=true. ADR-0001 holds the FE has no authority;
this trusted it anyway.

Adds DocumentStore.ForeignIds(ids, owner) and calls it from both write paths before
any write, 400 ProblemDetails on a mismatch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/ApplicationTests.cs

@@ -172,6 +172,51 @@ public class ApplicationTests(TestWebApplicationFactory factory) : IClassFixture
     }
   }
 
+  // --- WP-68 (F1): a citizen may only reference their own uploads — submit/draft-sync must
+  // reject a foreign documentId rather than silently attaching it. ---
+
+  private static async Task<UploadResponse> UploadAs(HttpClient client, string owner, string localId)
+  {
+    var content = new MultipartFormDataContent();
+    var file = new ByteArrayContent(new byte[] { 1, 2, 3 });
+    file.Headers.ContentType = new System.Net.Http.Headers.MediaTypeHeaderValue("application/pdf");
+    content.Add(file, "file", "d.pdf");
+    content.Add(new StringContent("diploma"), "categoryId");
+    content.Add(new StringContent(localId), "localId");
+    content.Add(new StringContent("registratie"), "wizardId");
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/uploads") { Content = content, Headers = { { "X-Subject", owner } } };
+    var res = await client.SendAsync(req);
+    Assert.Equal(HttpStatusCode.Created, res.StatusCode);
+    return (await res.Content.ReadFromJsonAsync<UploadResponse>())!;
+  }
+
+  [Fact]
+  public async Task Submitting_a_foreign_documentId_is_rejected_and_leaves_it_deletable_by_its_owner()
+  {
+    var foreignDoc = await UploadAs(_client, "999888777", Guid.NewGuid().ToString());
+    var a = await Create("registratie");
+
+    var res = await _client.PostAsJsonAsync($"/api/v1/applications/{a.Id}/submit",
+        new { diplomaHerkomst = "duo", documents = new[] { new { categoryId = "diploma", channel = "digital", documentId = foreignDoc.DocumentId } } });
+    Assert.Equal(HttpStatusCode.BadRequest, res.StatusCode);
+
+    // The rejected submit must not have flipped the foreign document's Linked flag — its
+    // owner can still delete it.
+    var deleteReq = new HttpRequestMessage(HttpMethod.Delete, $"/api/v1/uploads/{foreignDoc.DocumentId}") { Headers = { { "X-Subject", "999888777" } } };
+    Assert.Equal(HttpStatusCode.NoContent, (await _client.SendAsync(deleteReq)).StatusCode);
+  }
+
+  [Fact]
+  public async Task Draft_sync_with_a_foreign_documentId_is_rejected()
+  {
+    var foreignDoc = await UploadAs(_client, "999888777", Guid.NewGuid().ToString());
+    var a = await Create("registratie");
+
+    var res = await _client.PutAsJsonAsync($"/api/v1/applications/{a.Id}",
+        new { draft = new { }, stepIndex = 0, stepCount = 1, documentIds = new[] { foreignDoc.DocumentId } });
+    Assert.Equal(HttpStatusCode.BadRequest, res.StatusCode);
+  }
+
   // --- Auto-approval is computed on read: exercise the window boundary without waiting. ---
 
   private static Aanvraag Accepted(bool autoApprovable) => new()