feat(domain): werkbak query + GET /behandel/werkbak (refs #13)

The Werkbak use-case reads the open Beoordelen tasks (§8.2) and enriches each with
its aggregate's bsn + status; exposed as GET /behandel/werkbak for the BFF to proxy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -26,6 +26,7 @@ builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
+builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
 
@@ -73,6 +74,12 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
     return Results.NoContent();
 });
 
+// The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
+// Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
+// medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
+app.MapGet("/behandel/werkbak", async (Werkbak werkbak, CancellationToken ct) =>
+    Results.Ok(await werkbak.GetAsync(ct)));
+
 // Read a registration. Its zaak URL appears once the worker has opened the zaak (eventually).
 app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, CancellationToken ct) =>
 {