feat(zgw): docker OpenZaak integration-test harness (WP-54)

Opt-in docker-compose (postgres+redis+OpenZaak, no celery/nginx) +
bootstrap-catalogus.sh seed a real OpenZaak instance; OpenZaakIntegrationTests
(Category=Integration, excluded from default dotnet test/CI) proves the ZGW
seam against it for the first time. That live run caught a real bug:
ZgwHttpClient never sent Content-Crs/Accept-Crs headers, so every write would
412 against a spec-compliant OpenZaak — fixed alongside the harness.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/setup_configuration/data.yaml

@@ -0,0 +1,27 @@
+# Applied by web-init (RUN_SETUP_CONFIG=true → `manage.py setup_configuration`, upstream's
+# documented CLI config mechanism — see docker-compose.openzaak.yml) instead of the Django
+# admin. Creates the ONE application the bootstrap script + integration test authenticate as.
+#
+# ponytail: heeft_alle_autorisaties (all scopes) rather than a granular per-component/scope
+# list — this instance only ever exists for this harness/test, never a shared or prod
+# OpenZaak, so there's no least-privilege boundary worth modeling here.
+sites_config_enable: true
+sites_config:
+  items:
+    - domain: localhost:8000
+      name: OpenZaak (WP-54 harness)
+
+vng_api_common_credentials_config_enable: true
+vng_api_common_credentials:
+  items:
+    - identifier: bigregister-test
+      secret: bigregister-test-secret
+
+vng_api_common_applicaties_config_enable: true
+vng_api_common_applicaties:
+  items:
+    - uuid: 5a09b3c9-6a54-4b2b-8f3c-1f9b6b6a3a01
+      client_ids:
+        - bigregister-test
+      label: BIG-register BFF (WP-54 test harness)
+      heeft_alle_autorisaties: true