feat(bff): POST /self-service/registrations/{id}/withdraw, owner-scoped (refs #12)

The domain withdraw command carries the caller's bsn and owner-scopes the aggregate; unknown or

not-owned is 404 (indistinguishable). The BFF forwards the DigiD token's bsn and relays 204/404.

Regenerate the OpenAPI spec + Angular client for the new endpoint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Api/Program.cs

@@ -86,6 +86,24 @@ app.MapPost("/self-service/registrations", async (ClaimsPrincipal user, IDomainC
     .Produces(StatusCodes.Status400BadRequest)
     .Produces(StatusCodes.Status401Unauthorized);
 
+// Self-service withdrawal (S-11): the signed-in zorgprofessional withdraws their own registration.
+// The bsn comes from the DigiD token and is forwarded to the domain, which owner-scopes the action;
+// a registration that is unknown or not the caller's comes back 404 (ownership is not revealed).
+app.MapPost("/self-service/registrations/{id}/withdraw", async (string id, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
+{
+    var bsn = user.FindFirstValue("bsn");
+    if (string.IsNullOrWhiteSpace(bsn))
+        return Results.BadRequest("The token carries no bsn claim.");
+
+    var withdrawn = await domain.WithdrawRegistrationAsync(id, bsn, ct);
+    return withdrawn ? Results.NoContent() : Results.NotFound();
+})
+    .RequireAuthorization()
+    .Produces(StatusCodes.Status204NoContent)
+    .Produces(StatusCodes.Status400BadRequest)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status404NotFound);
+
 // Openbaar register: an anonymous public lookup that exposes only public-safe fields (S-09).
 app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection, CancellationToken ct) =>
 {