test(acl,domain): cover the approval-flow mutants to hold the ratchet (refs #75)

The new gateway/use-case code left surviving mutants (empty NoCoverage on the ACL
gateway status-set, plus unasserted error messages, null-guards, and the persist
call). Add stub-handler tests for SetZaakToEindstatusAsync (eindstatus resolution,
POST framing, failure paths) and assert the approve use case's messages, null
handling and SaveAsync. Local Stryker: acl 100%, domain 98.4%, event-subscriber 100%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/AclHttpClientTests.cs

@@ -64,4 +64,14 @@ public class AclHttpClientTests
         await Assert.ThrowsAsync<HttpRequestException>(
             () => client.ApproveZaakAsync(new Uri("http://openzaak/zaken/api/v1/zaken/abc")));
     }
+
+    [Fact]
+    public async Task Approve_rejects_a_null_zaak_url_without_sending_a_request()
+    {
+        var capture = new RequestCapture();
+        var client = Client(capture.Responds(HttpStatusCode.NoContent));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => client.ApproveZaakAsync(null!));
+        Assert.Null(capture.Seen);
+    }
 }