docs(openspec): add portal-citizen-create-actions ff change

[rubenvdlinde]

What

Spec-only OpenSpec ff change portal-citizen-create-actions (proposal + design + delta spec + tasks) — no code yet; tests + implementation land in the apply phase.

Lets an accountless citizen react to an open consultation and propose a participatory-budget item from the portaliq portal, through type: create actions whose scope is server-stamped from the subject — closing the write-IDOR class filed as portaliq#16. Today the citizen manifest is read + inbox only (actions: [], REQ-DKPORT-006).

Evidence

• createReaction on ConsultationReaction: client whitelist {consultation, body}; server set {submitterId: subjectRef, moderationStatus: 'pending', submittedAt: now}; only when parent PublicConsultation.status == 'open'.
• createBudgetProposal on BudgetProposal: client whitelist {participatoryBudget, title, description, requestedAmount, category}; server set {submitter: subjectRef, status: 'submitted'}; only when parent ParticipatoryBudget.status == 'submission'.
• Field names bound to the REAL shipped schemas verified at HEAD (decidesk_register.json), not the brief's generic names: parent ref is consultation; amount is requestedAmount; intake states are moderationStatus: 'pending' / status: 'submitted'. BudgetProposal has no submittedAt, so none is stamped (deviation noted in design).
• Write-IDOR closed: every scope/lifecycle/staff field is in the server set, never the client whitelist — a forged submitterId/submitter/status is ignored; moderation stays internal.
• Both actions minTrust: low (account-less participation is the point; DigiD/eHerkenning deferred) + rate-limit noted for apply.
• openspec validate portal-citizen-create-actions --strict passes.

🤖 Generated with Claude Code