refactor(mandates): one transition guard asks decidiq for delegated authority

[rubenvdlinde]

Refactor lane R9, capability C17 (decisions 182, 184, 185; hydra ADR-118). Builds on question Q6's recommended option: decidiq owns the mandate registry, dossiq keeps one generic transition guard that asks.

Pair: ConductionNL/decidiq#1696 (DelegatedAuthorityCheck). Land decidiq#1696 first. Without it, the guard refuses with "register absent". It never passes silently.

What changes

• New Service/Transitions/DelegatedAuthorityGuard, guard type delegatedAuthorityGuard. It asks decidiq's DelegatedAuthorityCheck through FleetAppId, so an instance running decidiq under its old id is still asked. Config: act or actField, optional actorField (default signatory, then the current user) and amountField (euro cents, ADR-031).
• GuardRegistry keeps answering the legacy type mandaatGuard with the same guard and actField: mandaatCategorie. Workflow definitions stored on live instances keep working.
• bvw-mandaatbesluit declares { "type": "delegatedAuthorityGuard", "actField": "mandaatCategorie" }.
• Deleted: Transitions/MandaatGuard, MandaatValidationService (external mandaatregister over HTTP), MandaatController and its route GET /api/besluitvorming/cases/{id}/mandaat-check (no frontend caller), the config keys mandaatregister_endpoint and mandaatregister_token, and their two unit test files.
• Every uncertain answer refuses: no decidiq, a decidiq that throws, no act on the case, an amount that is not a number. The old mandaatHandmatigBevestigd pass is gone. No schema declares that field and no screen sets it (question Q8).
• OpenSpec change delegated-authority-guard (status-transition-engine ADDED, REQ-BVW-007 MODIFIED).

Not in this PR

• The mandate matrix (MandaatCheckService, MandaatEscalatieService, MandaatGebruikService, MandaatImportService, Mandaat/*, MandaatMatrixController, MandaatRegistryController, the settings tabs, 61-mandaat-matrix.json) moves in pair 2. It waits for fix(mandate): conflict-of-interest service no longer carries a dead manual-override path #3300, which edits ConflictOfInterestService, a dependency of MandaatCheckService.
• Beschikking/MandaatVerifier sits inside BeschikkingService, which lane R5 owns until its waits land. It moves onto this guard in coordination with R5.

Verified

• tests/Unit/Service/Transitions/ (includes the new DelegatedAuthorityGuardTest, 5 tests against a neutral fixture case type): 168 tests, exit 0.
• tests/Unit/Lifecycle 58 tests, tests/Unit/Settings 298 tests (WorkflowGuardConformance reads the changed template), tests/Unit/Architecture 96 tests, tests/Unit/Service/Settings 18 tests, tests/Unit/AppInfo 78 tests, RefusalCarriesAStatusTest 12 tests: all exit 0.
• phpcs on the changed lib files: exit 0. phpmd on the guard and the registry: exit 0.
• phpstan on the guard and GuardRegistry through the slot: exit 0.
• No full check:strict slot started within 10 minutes (the fleet held both), so psalm and the full suite are left to CI on this PR; CI is the full check.

Inherited: none touched.

Still owed (live instance): a Mandaatbesluit case with and without a decidiq toedeling for its mandaatCategorie, advancing Vergadering to Besluit genomen.