feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55)

docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site
domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the
WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a
front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a
file setup_configuration reads rather than a compose env var, so it's
templated (data.prod.yaml.template, no secret) and rendered host-side via
render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the
container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration,
so the BFF side needed no code change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/docker-compose.openzaak.prod.yml

@@ -0,0 +1,37 @@
+# WP-55 — production overrides for docker-compose.openzaak.yml: real secrets, real DB auth,
+# HTTPS-aware settings. Use ON TOP of the base file, never alone (it has no image/ports of its
+# own to add — see backend/openzaak/README.md for the required env vars and full flow):
+#
+#   ./render-prod-secrets.sh   # renders setup_configuration/data.prod.yaml (gitignored)
+#   docker compose -f docker-compose.openzaak.yml -f docker-compose.openzaak.prod.yml up -d
+#
+# TLS is NOT terminated here — OpenZaak sits behind a reverse proxy/ingress that owns the
+# certificate; this file only tells OpenZaak (via IS_HTTPS) that it's being served over HTTPS
+# so it sets secure cookies / redirects correctly.
+services:
+  db:
+    environment:
+      - POSTGRES_HOST_AUTH_METHOD=md5
+      - POSTGRES_PASSWORD=${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
+
+  web-init:
+    environment:
+      SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
+      DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
+      IS_HTTPS: 'yes'
+      SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
+      ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
+      DISABLE_2FA: 'false'
+    volumes:
+      # Shadows the dev data.yaml (still mounted read-only from the base file) with the
+      # secret-free template rendered by render-prod-secrets.sh.
+      - ./setup_configuration/data.prod.yaml:/app/setup_configuration/data.yaml:ro
+
+  web:
+    environment:
+      SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
+      DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
+      IS_HTTPS: 'yes'
+      SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
+      ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
+      DISABLE_2FA: 'false'