feat(domain): ApproveRegistration use case + temp /registrations/{id}/approve endpoint (refs #75)

Loads the registration, asks the ACL to set its zaak's final status (new
IAclClient.ApproveZaakAsync → POST /statussen), then advances the aggregate to
INGESCHREVEN. Idempotent: a repeated approval is a no-op. Adds HTTP-adapter tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Infrastructure/AclHttpClient.cs

@@ -22,7 +22,18 @@ public sealed class AclHttpClient(HttpClient http, AclOptions options) : IAclCli
         return new Uri(opened.ZaakUrl);
     }
 
+    public async Task ApproveZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        using var response = await http.PostAsJsonAsync(
+            new Uri(options.BaseUrl, "statussen"), new SetStatusRequest(zaakUrl.ToString()), ct);
+        response.EnsureSuccessStatusCode();
+    }
+
     private sealed record OpenZaakRequest([property: JsonPropertyName("bsn")] string Bsn);
 
     private sealed record OpenZaakResponse([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
+
+    private sealed record SetStatusRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
 }