feat(behandelportal): WP-65b beoordeling besluit (decision write)

Adds POST /beoordeling/{id}/besluit: a Besluit enum (Goedkeuren/Afwijzen/
MeerInfoOpvragen) backed by new Aanvraag.BesluitStatus/BesluitToelichting
columns, gated by the same BeoordelingRules.CanDecide the read side's
canBesluiten flag already uses (409 on an illegal transition, 400 on a
missing required toelichting). Mappers.ToStatusDto gains the "a recorded
decision wins" branch. FE: besluit.machine.ts + besluit-form organism
(same form idiom as change-request-form), wired into the beoordeling page
behind the server's canBesluiten flag.

Completes WP-65 (65a + 65b) — verified end-to-end against a running
backend (werkvoorraad -> beoordeling -> besluit -> status reflected back).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -442,6 +442,40 @@ api.MapGet("/beoordeling/{id}", (string id, HttpContext ctx, IZaakSource zaken)
 .ProducesProblem(StatusCodes.Status403Forbidden)
 .Produces(StatusCodes.Status404NotFound);
 
+// --- Besluit (WP-65b): record a behandelaar's decision, advancing the WP-63 status
+// lifecycle. Runs against ApplicationStore directly (not the IZaakSource seam) — same
+// reasoning as the GET above: a new seam method would force an OpenZaakZaakSource
+// write now, which is WP-66's surface, not this one's. The transition-legality check
+// (BeoordelingRules.CanDecide) is the SAME function the GET's canBesluiten flag uses,
+// so the two can never drift.
+api.MapPost("/beoordeling/{id}/besluit", (string id, RecordBesluitRequest req, HttpContext ctx) =>
+    Beoordelen(ctx, $"aanvraag/{id}/besluit", () =>
+    {
+      if (!Enum.TryParse<Besluit>(req.Besluit, out var besluit))
+        return Results.Problem(detail: $"Onbekend besluit '{req.Besluit}'.", statusCode: StatusCodes.Status400BadRequest);
+
+      var now = DateTimeOffset.UtcNow;
+      var a = ApplicationStore.GetAny(id);
+      var statusTag = a?.ToStatusDto(now).Tag;
+      if (a is null || statusTag == "Concept") return Results.NotFound();
+      var current = Enum.Parse<AanvraagStatusTag>(statusTag!);
+      if (!BeoordelingRules.CanDecide(current))
+        return Results.Problem(
+            detail: "Deze aanvraag staat geen besluit meer toe in de huidige status.",
+            statusCode: StatusCodes.Status409Conflict);
+      if (besluit != Besluit.Goedkeuren && string.IsNullOrWhiteSpace(req.Toelichting))
+        return Results.Problem(detail: "Toelichting is verplicht bij dit besluit.", statusCode: StatusCodes.Status400BadRequest);
+
+      var updated = ApplicationStore.RecordBesluit(id, besluit, req.Toelichting)!;
+      app.Logger.LogInformation("aanvraag besluit id={Id} besluit={Besluit}", id, besluit);
+      return Results.Ok(new RecordBesluitResponse(updated.ToStatusDto(now)));
+    }))
+.Produces<RecordBesluitResponse>()
+.ProducesProblem(StatusCodes.Status400BadRequest)
+.ProducesProblem(StatusCodes.Status403Forbidden)
+.ProducesProblem(StatusCodes.Status409Conflict)
+.Produces(StatusCodes.Status404NotFound);
+
 // OpenZaak's Notificaties API (NRC) calls this on every zaak event once an `abonnement` is
 // provisioned (WP-52, out-of-band — see openzaak-integration.md, no app code subscribes it).
 // The caller is NRC, not a user: no Principal, so this audits via AuthzAuditStore directly