feat(domain): withdrawal — INGETROKKEN transition + endpoint (S-11a, refs #12) (#88)

## What & why

First sub-slice of **S-11 · Withdrawal (Flow 3)** (#12). A zorgprofessional can withdraw a still-open registration ("trek aanvraag in"); this sub-slice delivers the **domain transition + endpoint**, mirroring how S-12a shipped the beoordeling decision model on its own (#82).

- `RegistrationStatus.Ingetrokken` (terminal).
- `Registration.Withdraw()` — allowed from INGEDIEND or IN_BEHANDELING, needs no zaak, idempotent, and rejected once the registration has been decided (INGESCHREVEN/AFGEWEZEN).
- `WithdrawRegistration` application handler (load → withdraw → persist; repeated withdrawal is a no-op).
- `POST /registrations/{id}/withdraw` on the domain API.

Demoable: `POST /registrations/{id}/withdraw` → `GET /registrations/{id}` shows `INGETROKKEN`.

Refs #12 (not closing — see below).

## Scope / follow-ups

S-11 is bigger than one slice, so it is split (CLAUDE.md §13), like S-12 was:
- **S-11a (this PR)** — domain withdrawal transition + endpoint.
- **S-11b** — cancel the running Flowable process via a BPMN message event, so a withdrawn case leaves the behandelaar's werkbak.
- **S-11c** — owner-scoped BFF self-service withdraw endpoint + "trek aanvraag in" button + e2e.

Cancelling the Flowable process is deliberately deferred (documented in `WithdrawRegistration`), exactly as the beoordeling's rejection deferred its zaak propagation. #12 stays open until S-11c.

## Definition of Done

- [x] Linked Gitea issue (#12).
- [x] Failing test committed before the implementation.
- [x] Implementation makes the test pass.
- [x] Conventional Commits referencing the issue (`refs #12`).
- [ ] CI green — all Gitea Actions jobs.
- [x] `docker compose up` unaffected (no infra/contract change).
- [x] Docs — none needed for this backend sub-slice; the user-visible demo note lands with S-11c.
- [x] No ADR needed — mirrors existing aggregate/handler/endpoint patterns; no boundary change.

## Notes for reviewers

- Verified locally: `Big.Tests` 89/89 pass; `Big.Api` builds clean.
- The domain trusts its callers (§8.3); owner-scoping by the caller's bsn is enforced at the BFF in S-11c.

Reviewed-on: #88

services/domain/Big.Tests/WithdrawRegistrationTests.cs

@@ -0,0 +1,60 @@
+using Big.Application;
+using Big.Domain;
+
+namespace Big.Tests;
+
+public class WithdrawRegistrationTests
+{
+    [Fact]
+    public async Task Withdrawing_marks_the_registration_ingetrokken_and_persists_it()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Registration.Submit("123456782");
+        store.Seed(registration);
+        var handler = new WithdrawRegistration(store);
+
+        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+
+        var saved = await store.GetAsync(registration.Id);
+        Assert.Equal(RegistrationStatus.Ingetrokken, saved!.Status);
+        Assert.Equal(1, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Rejects_a_null_command_without_touching_the_store()
+    {
+        var store = new FakeRegistrationStore();
+        var handler = new WithdrawRegistration(store);
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
+        Assert.Equal(0, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Withdrawing_an_unknown_registration_throws()
+    {
+        var store = new FakeRegistrationStore();
+        var handler = new WithdrawRegistration(store);
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => handler.HandleAsync(new WithdrawRegistrationCommand(RegistrationId.New())));
+        Assert.Contains("No registration", ex.Message);
+        Assert.Equal(0, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Re_withdrawing_an_already_ingetrokken_registration_is_idempotent()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Registration.Submit("123456782");
+        store.Seed(registration);
+        var handler = new WithdrawRegistration(store);
+
+        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+        await handler.HandleAsync(new WithdrawRegistrationCommand(registration.Id));
+
+        // The second withdrawal is a no-op: the aggregate is not persisted again.
+        Assert.Equal(1, store.SaveCount);
+        Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
+    }
+}