feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55)

docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site
domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the
WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a
front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a
file setup_configuration reads rather than a compose env var, so it's
templated (data.prod.yaml.template, no secret) and rendered host-side via
render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the
container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration,
so the BFF side needed no code change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/render-prod-secrets.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# WP-55 — renders setup_configuration/data.prod.yaml.template into the gitignored
+# data.prod.yaml docker-compose.openzaak.prod.yml mounts over the container's data.yaml.
+# Run this once before `docker compose ... up` in a production deploy; re-run whenever the
+# secrets rotate. Fails fast (no output file) if a required env var is missing — never
+# silently falls back to a real-looking default.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+: "${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set (e.g. open-zaak.example.org)}"
+: "${OPENZAAK_CLIENT_ID:?OPENZAAK_CLIENT_ID must be set}"
+: "${OPENZAAK_CLIENT_SECRET:?OPENZAAK_CLIENT_SECRET must be set}"
+: "${OPENZAAK_APPLICATIE_UUID:?OPENZAAK_APPLICATIE_UUID must be set (a fresh UUID, e.g. \$(uuidgen))}"
+
+envsubst < setup_configuration/data.prod.yaml.template > setup_configuration/data.prod.yaml
+echo "Wrote setup_configuration/data.prod.yaml"