feat(acl): CancelZaakAsync service + POST /annuleringen endpoint (S-10c) (refs #106)

The ACL exposes zaak cancellation as a service operation the domain calls on
document-timeout expiry; it default-fills the zaaktype and dates the status
today, translating the domain intent to the ZGW cancellation status/resultaat.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Application/AclService.cs

@@ -30,6 +30,18 @@ public sealed class AclService(IZaakGateway gateway, AclDefaults defaults, ICloc
         return gateway.SetZaakToEindstatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
     }
 
+    /// <summary>
+    /// Cancel a zaak on document-timeout expiry (S-10c): set it to the configured BIG zaaktype's
+    /// cancellation statustype + resultaat. The domain hands over only the zaak URL; the ACL owns which
+    /// statustype/resultaat means "cancelled" (§8.1).
+    /// </summary>
+    public Task CancelZaakAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        return gateway.SetZaakToCancellationStatusAsync(zaakUrl, defaults.ZaaktypeUrl, clock.Today, ct);
+    }
+
     /// <summary>The zaak's reference (its ZGW identificatie), for the read projection (#78).</summary>
     public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
     {