feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55)

docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site
domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the
WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a
front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a
file setup_configuration reads rather than a compose env var, so it's
templated (data.prod.yaml.template, no secret) and rendered host-side via
render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the
container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration,
so the BFF side needed no code change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/WP-65-behandelportal-beoordeling.md

@@ -7,7 +7,7 @@ Phase: 11 — Behandelportal
 
 The core case-treatment write path — a medewerker opens one aanvraag's detail (including
 its documents) and records a decision (goedkeuren/afwijzen/meer info opvragen), advancing
-the status lifecycle WP-63 published. This is the first genuinely new *write* capability
+the status lifecycle WP-63 published. This is the first genuinely new _write_ capability
 in the system beyond what the citizen SSP already does to itself.
 
 ## Read first