feat(#13): S-12c-2 — behandel decide → domain + complete workflow task (#86)

## What & why

Second half of **S-12c** (behandel-portal backend), completing the decision path per **ADR-0013**:

- **Domain:** `BeoordeelRegistratie` now, after applying the decision (aggregate + ACL for approval), **completes the open Flowable `Beoordelen` task** for that registration (found by registrationId) with the besluit, so the workflow advances. No open task → the decision still stands (completes nothing); idempotent.
- **BFF:** `POST /behandel/registrations/{id}/decide` behind the medewerker/`behandelaar` policy, forwarding `goedkeuren`/`afwijzen` to the domain. Validates the besluit vocabulary (400 on unknown) without troubling the domain.

Behavior: decide is **401** without a token, **403** without the role, **400** for an unknown besluit, **204** (forwarded) for a behandelaar.

This completes the behandel backend. **S-12d** (the Angular behandel-portal + Playwright e2e) closes umbrella #13 and retires the temporary `/approve`.

## Definition of Done

- [x] Linked issue: #13 (umbrella, `refs`)
- [x] Tests first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 79, bff 27, acceptance 9 (acl/event-subscriber unaffected)
- [x] Beoordeling acceptance scenario asserts task completion (goedkeuren + afwijzen)
- [x] openapi.json + api-client regenerated (drift guard passes)
- [x] Mutation ≥ break(90): **domain 100%, bff 100%**
- [ ] CI green (pending)

Part of #13.

Reviewed-on: #86

tests/acceptance/Features/EenRegistratieBeoordelen.feature

@@ -15,6 +15,7 @@ Feature: Een registratie beoordelen
     When the behandelaar decides "goedkeuren"
     Then the registration has status "INGESCHREVEN"
     And the zaak's final status is set via the ACL
+    And the beoordeling task is completed with "goedkeuren"
 
   Scenario: Afwijzen wijst de registratie af zonder de ACL
     Given a submitted registration with an opened zaak
@@ -22,3 +23,4 @@ Feature: Een registratie beoordelen
     And the behandelaar decides "afwijzen"
     Then the registration has status "AFGEWEZEN"
     And the ACL is not asked to set the zaak status
+    And the beoordeling task is completed with "afwijzen"