feat(backend): expand stamdata + OpenZaak-ready cases seam (WP-49)

Stamdata: add beroepen, opleidingen (temporal), and specialismen tables to the
schema-driven catalog (zero UI code). opleidingen.beroep and specialismen.beroep
both reference beroepen.code — the first stamdata->stamdata references, enforced by
two new StamdataRef entries in the CI gate.

OpenZaak/ZGW (WP-49, slice 1 — read-only zaken): introduce IZaakSource as the cases
read seam. Default LocalZaakSource reads the local SQLite store (offline); an
OpenZaakZaakSource (Zgw/ client: HS256 per-call JWT, ZGW->existing-DTO mapper,
paginating HTTP source) is selected behind Zgw:Enabled (default false). The FE never
changes — same ApplicationSummaryDto, no api-client drift. Unit-tested with fixtures
+ a stub HttpMessageHandler; no live OpenZaak needed.

Docs: ADR-0005, reference/openzaak-integration.md, WP-49..52 roadmap, stamdata.md
update, README index rows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/WP-50-openzaak-create-zaak.md

@@ -0,0 +1,52 @@
+# WP-50 — OpenZaak create-zaak (first write slice)
+
+Status: todo
+Phase: 9 — OpenZaak / ZGW integration
+
+## Why
+
+WP-49 made the cases **read** path source-swappable. The next slice is the first **write**:
+create a Zaak in OpenZaak when an aanvraag is submitted, still behind the config gate, still
+without changing the FE contract.
+
+## Read first
+
+- [openzaak-integration.md](../reference/openzaak-integration.md) — "How to add the next slice"
+- [ADR-0005](../reference/architecture/0005-openzaak-behind-bff.md), [ADR-0001](../reference/architecture/0001-bff-lite-decision-dtos.md)
+
+## Decisions (pre-made, don't relitigate)
+
+- Route the create through the existing submit/mutation seam; keep the FE response DTO identical.
+- A create needs a `zaaktype` **URL** from Catalogi (OpenZaak validates it by fetching) — map
+  the aanvraag `type` → a configured zaaktype URL.
+- Follow the create with a `status` + a `rol` (initiator/betrokkene by BSN) as ZGW expects.
+
+## Files
+
+- Extend `IZaakSource` (or add a write method) + `OpenZaakZaakSource`; `LocalZaakSource` keeps
+  the current local submit.
+- `ZgwOptions`: a `type → zaaktype URL` map + `bronorganisatie`/`verantwoordelijkeOrganisatie` (RSIN).
+
+## Steps
+
+1. Add `CreateZaak` to the source seam; local impl = current submit, OpenZaak impl = POST to ZRC.
+2. Map aanvraag `type` → zaaktype URL; POST zaak, then status + rol.
+3. Map the created Zaak back into the existing submit response DTO.
+
+## Acceptance criteria
+
+- [ ] Submitting with `Zgw:Enabled=true` creates a Zaak (+ status + rol) in OpenZaak.
+- [ ] FE submit response DTO unchanged; no api-client drift.
+- [ ] Covered by tests (stub handler asserts the POST bodies + type→zaaktype mapping).
+
+## Verification
+
+`dotnet test`; against a docker OpenZaak if available.
+
+## Out of scope
+
+Documenten (WP-51), Notificaties (WP-52).
+
+## Risks
+
+Create needs read scope on Catalogi (type-URL validation) — provision AC scopes accordingly.