docs(withdrawal): demo-script + frontend decision for 'trek aanvraag in' (refs #12)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/demo-script.md

@@ -275,3 +275,26 @@ ACL → NRC → event-subscriber → projection → openbaar register shows INGE
 > The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
 > public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
 > drives the behandel portal in place of the old admin endpoint.
+
+## S-11 — Withdrawal: "trek aanvraag in" (#12, ADR-0014)
+
+A zorgprofessional can withdraw their own still-open registration from the self-service portal. The
+withdrawal is owner-scoped (the BFF forwards the DigiD token's bsn; the domain only lets the owner
+withdraw) and cancels the running workflow via a BPMN message event, so the case leaves the
+behandelaar's werkbak.
+
+```text
+# 1. Log in and submit at the self-service portal (http://localhost:8140/, jan-burger / test123),
+#    note the "Referentie" on the confirmation.
+# 2. Click "Trek aanvraag in" → the page confirms the registration is ingetrokken.
+# 3. In the behandel werkbak (http://localhost:8142/, merel-behandelaar) the registration no longer
+#    appears — its Beoordelen task was cancelled.
+```
+
+**The path:** self-service → BFF `POST /self-service/registrations/{id}/withdraw` (DigiD, owner-scoped)
+→ domain sets INGETROKKEN + correlates the `RegistratieIngetrokken` message to the process → the
+interrupting boundary event ends it → the werkbak drops the case.
+
+> DigiD submit → trek aanvraag in → ingetrokken is the Playwright happy path
+> (`tests/e2e/withdrawal.spec.ts`); the owner-scoping + workflow cancellation are covered by the
+> `Een registratie intrekken` acceptance scenarios and the domain live check.

docs/frontend-decisions.md

@@ -151,3 +151,19 @@ frontend work is the medewerker realm auth and the werkbak/decide page. Wiring r
   to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
   The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
   path.
+
+## Self-service withdrawal: "trek aanvraag in" (S-11c, #12)
+
+The submit confirmation grows a **"Trek aanvraag in"** action so a zorgprofessional can withdraw the
+registration they just submitted (`apps/self-service`, on the existing `RegistrationPage`).
+
+- **Keyed by the reference, owner-scoped at the BFF.** The button calls the generated
+  `postSelfServiceRegistrationsIdWithdraw(reference)` with the reference the submit returned. The
+  DigiD token (attached by the interceptor) carries the bsn the BFF forwards; the domain only lets
+  the owner withdraw (a mismatch is 404). No extra identity is entered in the UI.
+- **Same confirm-and-surface pattern as submit.** A secondary-action button; on success the page
+  switches to an ingetrokken confirmation; a failure is surfaced (`role="alert"`) and the action
+  stays available to retry — mirroring how submit handles its failure rather than swallowing it.
+- **Testing.** Component tests (`@testing-library/angular`, mocked BFF) cover the button appearing
+  after submit, the reference being passed, the ingetrokken confirmation, and the failure path; the
+  browser round-trip is `tests/e2e/withdrawal.spec.ts`.