docs(backlog): add phase 10 (OpenZaak hardening) and phase 11 (behandelportal)

WP-55..60 harden the OpenZaak integration for production (secrets/TLS,
idempotent provisioning, least-privilege scopes, real notifications,
confidentialiteit config, write-divergence resilience). WP-61..66 stand up
a staff-facing behandelportal per ADR-0002, wired to the same backend via
BFF-lite decision DTOs. Both phases are independent tracks; WP-60's
Decisions block is deliberately left open for a planner-agent kickoff.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/WP-57-openzaak-least-privilege-scopes.md

@@ -0,0 +1,61 @@
+# WP-57 — Least-privilege client scopes
+
+Status: todo
+Phase: 10 — OpenZaak production hardening
+
+## Why
+
+The harness's OpenZaak client is granted `heeft_alle_autorisaties: true` in
+`setup_configuration/data.yaml` — acceptable for a disposable test rig, wrong for anything
+closer to production, where the BFF's client should hold only the Autorisaties it actually
+exercises.
+
+## Read first
+
+- `backend/openzaak/setup_configuration/data.yaml`
+- `backend/src/BigRegister.Api/Zgw/OpenZaakZaakSource.cs` and `OpenZaakDocumentSource.cs`
+  (the actual ZGW endpoints/verbs called)
+
+## Decisions (pre-made, don't relitigate)
+
+- Scope precisely to what the BFF calls today: zaken (aanmaken, bijwerken, lezen),
+  statussen (aanmaken), rollen (aanmaken), documenten/zaakinformatieobjecten (aanmaken,
+  lezen) — enumerate exactly at kickoff from the client code, don't guess broader.
+- No wildcard/all-scope grant in any environment beyond the pre-WP-56 disposable dev rig.
+
+## Files
+
+- `backend/openzaak/setup_configuration/data.yaml` (Autorisaties block)
+- `backend/openzaak/README.md`
+
+## Steps
+
+1. Grep `OpenZaakZaakSource.cs` and `OpenZaakDocumentSource.cs` for every ZGW
+   endpoint/verb called.
+2. Replace `heeft_alle_autorisaties: true` with an explicit `autorisaties` list matching
+   exactly that set.
+3. Re-run the full integration suite against the narrowed client; add any scope a 403
+   surfaces.
+
+## Acceptance criteria
+
+- [ ] Client config has no wildcard/all-scopes grant.
+- [ ] `OpenZaakIntegrationTests` (WP-54) pass unchanged against the narrowed client.
+
+## Verification
+
+`cd backend && dotnet test --filter Category=Integration` against the harness with the
+narrowed client.
+
+## Out of scope
+
+Rotating/expiring the client credential itself — defer until multi-tenant/production ops
+actually need it.
+
+## Risks
+
+An overlooked scope only surfaces as a runtime 403 against a real instance — mitigated by
+running the full integration suite, which already exercises every current call path
+(WP-54).
+
+Depends on: WP-56 (provisioning mechanism this scopes down).