The walking-skeleton happy path now drives the real S-12 flow: after submit, a behandelaar logs in to the behandel portal (medewerker realm), finds the registration in the werkbak by its reference, and clicks Goedkeuren — replacing the temporary domain admin endpoint. Treat the behandel origin as secure too, for its PKCE login. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>