Scaffold apps/behandel (mirrors self-service): medewerker-realm OIDC login, the werkbak page
listing registrations awaiting beoordeling (GET /behandel/werkbak) with goedkeuren/afwijzen
actions (POST /behandel/registrations/{id}/decide) that refresh the list, plus Dockerfile and
same-origin nginx reverse proxy for /behandel/ (ADR-0013; S-12).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drives the behandel-portal frontend: the werkbak lists registrations awaiting beoordeling, a
decision (goedkeuren/afwijzen) posts to the BFF and refreshes, an empty werkbak and a load
failure are surfaced, the page is WCAG 2.1 AA clean, and the medewerker token attaches to the
relative /behandel/ calls (and not to the anonymous openbaar register).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
