[EPIC E8] Implement consent revocation with mock Mitz

[JorisHeadease]

Implement the optional consent-revocation ending with the mock Mitz while keeping the Knooppunt-side consent and authorization protocols real.

Work items

• Promote test/mitzmock from an e2e helper to a standalone service.
• Add controllable consent answers with deterministic reset behavior.
• Deliver a notification to the subscription created during patiëntaanmelding.
• Correlate the notification to the patient and current demo run.
• Show the notification in the EHR and remove previously retrieved De Zonnebloem data.
• Run a fresh authorization attempt so the PDP performs a new Mitz closed question and denies retrieval fail-closed.
• Restore the happy path when consent is restored.

Acceptance criteria

• Revoking consent produces an EHR notification.
• Previously retrieved source data disappears from the overview.
• Re-retrieval is denied at the consent check and exposes no data.
• Restoring consent restores the successful retrieval path.
• Reset restores the configured initial consent state.

Out of scope

• Writing consent into the real Mitz environment.
• Implementing the Toestemmingsbericht interface.
• Test-Mitz onboarding for the hosted demo.

The mock is deliberate: the demo needs instant, deterministic consent changes and reset, while the Knooppunt still performs its real closed-question and subscription flows against that mock.

Frontend constraint

Use vendored Datastar as the initial frontend implementation. Keep backend routes, the step-event JSON schema, CSS/design tokens and the framework-free journey-map driver independent of Datastar. If the documented fallback triggers occur, the AI-assisted migration replaces Datastar with buildless Preact + htm in one cutover.

Depends on #541, #544 and #543.

Refs #532
Refs #538