test(e2e): isolate the self-service specs with dedicated DigiD users (refs #111)

Resume-on-load (S-26) restores any open registration for the logged-in bsn, so on the
shared verify stack the specs can no longer share jan-burger: verify-domain submits as
jan-burger (123456782) before the e2e, and that open registration was being resumed on
login. Each self-service spec now uses its own citizen — registration→emma-burger,
resume→sanne-burger, withdrawal→lars-burger — none touched by the verify-* checks or
each other. jan-burger stays the documented citizen for the API-level verify checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/keycloak/realms/digid-realm.json

@@ -38,6 +38,36 @@
       "emailVerified": true,
       "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
       "attributes": { "bsn": ["123456782"] }
+    },
+    {
+      "username": "sanne-burger",
+      "enabled": true,
+      "firstName": "Sanne",
+      "lastName": "Burger",
+      "email": "sanne.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477813"] }
+    },
+    {
+      "username": "emma-burger",
+      "enabled": true,
+      "firstName": "Emma",
+      "lastName": "Burger",
+      "email": "emma.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477805"] }
+    },
+    {
+      "username": "lars-burger",
+      "enabled": true,
+      "firstName": "Lars",
+      "lastName": "Burger",
+      "email": "lars.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477821"] }
     }
   ]
 }