feat(domain): ProvideDocuments completes the wait + POST /registrations/{id}/documents (refs #102)

The provide-documents use case completes the WachtOpDocumenten task via the
Workflow Client (owner-scoped by bsn, best-effort), exposed as an owner-scoped
domain endpoint. This is the trigger that unblocks the process; the real file
upload + ZGW storage lands in S-10b.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -29,6 +29,7 @@ builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
 builder.Services.AddScoped<WithdrawRegistration>();
+builder.Services.AddScoped<ProvideDocuments>();
 builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
@@ -107,6 +108,23 @@ app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRequest bo
     return outcome == WithdrawOutcome.Withdrawn ? Results.NoContent() : Results.NotFound();
 });
 
+// Provide documents (S-10a): the zorgprofessional supplies the documents their registration is parked
+// waiting for, completing the WachtOpDocumenten task so the process advances to beoordeling (ADR-0017).
+// Owner-scoped by the caller's bsn (the BFF forwards it from the DigiD token); unknown or not-the-
+// caller's is 404 (indistinguishable). Idempotent — completing an already-left wait is a no-op. The
+// real file upload + ZGW storage is S-10b; this endpoint is the trigger that unblocks the process.
+app.MapPost("/registrations/{id}/documents", async (string id, ProvideDocumentsRequest body, ProvideDocuments provide, CancellationToken ct) =>
+{
+    if (!Guid.TryParse(id, out var guid))
+        return Results.NotFound();
+
+    if (string.IsNullOrWhiteSpace(body?.Bsn))
+        return Results.BadRequest(new { error = "A bsn is required to provide documents." });
+
+    var outcome = await provide.HandleAsync(new ProvideDocumentsCommand(new RegistrationId(guid), body.Bsn), ct);
+    return outcome == ProvideDocumentsOutcome.Accepted ? Results.NoContent() : Results.NotFound();
+});
+
 // The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
 // Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
 // medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
@@ -134,6 +152,8 @@ public sealed record DecideRequest(string Besluit);
 
 public sealed record WithdrawRequest(string Bsn);
 
+public sealed record ProvideDocumentsRequest(string Bsn);
+
 public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);
 
 public partial class Program;