feat(openzaak): one-command UI-OpenZaak bridge, real BSN fix, flake mitigation

scripts/openzaak-ui-up.sh brings up the root app and the OpenZaak harness
together, wires them onto one docker network, seeds the catalogus, grants
the container-alias zaaktype scope, and verifies a real aanvraag submitted
through the UI lands in OpenZaak.

Along the way: DocumentStore.DemoOwner was reusing the seeded doctor's
11-digit BIG-nummer as a stand-in BSN, which isn't a valid 9-digit BSN shape
— OpenZaak rejects it, breaking both submit's rol-creation step and the
citizen's own applications list under Zgw:Enabled=true. Fixed to a real
elfproef-valid BSN.

Also adds mitigation for a still-unexplained per-container flake (every
outbound ZGW POST fails as if the body were empty, for that container's
whole lifetime) that correlates with host memory pressure: the script now
warns when host swap is heavily used, and an opt-in ZgwDiagnosticHandler
(ZGW_DEBUG_HTTP=1) logs Content-Length vs. actual bytes sent so the next
reproduction can confirm or rule out client-side body corruption.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -36,8 +36,16 @@ public sealed record AuditEntry(DateTimeOffset At, string Action, string Documen
 /// </summary>
 public static class DocumentStore
 {
-  /// The single seeded user (the demo has no real auth; ownership = this id).
-  public const string DemoOwner = "19012345601";
+  /// The single seeded user (the demo has no real auth; ownership = this id) — a real,
+  /// elfproef-valid 9-digit BSN (src/app/shared/kernel/bsn.ts's own checksum), distinct from
+  /// SeedData.Registration.BigNummer ("19012345601", 11 digits — the seeded doctor's BIG-nummer,
+  /// a different Dutch identifier scheme). Previously this constant reused that BigNummer value
+  /// as a stand-in BSN, which is invalid Dutch-BSN shape: harmless against the local store, but
+  /// a real OpenZaak instance rejects it outright — GET /api/v1/applications 500s (`inpBsn` query
+  /// filter validation) and every submit's rol-creation POST fails (`inpBsn` max_length) once
+  /// Zgw:Enabled=true. Not "111222333" or "999888777" — both already mean a different fixture
+  /// identity (the OpenZaak-harness/unit-test caller, and ApplicationTests' "other citizen").
+  public const string DemoOwner = "123456782";
 
   private static readonly object _gate = new();
 

backend/src/BigRegister.Api/Program.cs

@@ -61,9 +61,18 @@ if (zgw.Enabled)
   // WP-60: a bounded client timeout matters once ZgwHttpClient retries — without one, the
   // sources' sync-over-async call (no CancellationToken threaded through) could block a
   // thread-pool thread for HttpClient's 100s default times 3 attempts.
-  builder.Services.AddHttpClient<IZaakSource, OpenZaakZaakSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+  var zaakClientBuilder = builder.Services.AddHttpClient<IZaakSource, OpenZaakZaakSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
   // WP-51: the documents (Documenten API / DRC) seam — same pattern as IZaakSource above.
-  builder.Services.AddHttpClient<IDocumentSource, OpenZaakDocumentSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+  var documentClientBuilder = builder.Services.AddHttpClient<IDocumentSource, OpenZaakDocumentSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+
+  // Opt-in diagnostic for the still-unexplained per-container flake (see
+  // scripts/openzaak-ui-up.sh's header comment) — off by default, zero cost unless set.
+  if (Environment.GetEnvironmentVariable("ZGW_DEBUG_HTTP") == "1")
+  {
+    builder.Services.AddTransient<ZgwDiagnosticHandler>();
+    zaakClientBuilder.AddHttpMessageHandler<ZgwDiagnosticHandler>();
+    documentClientBuilder.AddHttpMessageHandler<ZgwDiagnosticHandler>();
+  }
 }
 else
 {

backend/src/BigRegister.Api/Zgw/ZgwDiagnosticHandler.cs

@@ -0,0 +1,25 @@
+namespace BigRegister.Api.Zgw;
+
+/// <summary>
+/// Opt-in only (wired in <c>Program.cs</c> behind <c>ZGW_DEBUG_HTTP=1</c>) — chases the
+/// still-unexplained flake where a freshly-(re)started `api` container has every outbound ZGW
+/// POST fail with what looks like an empty body reaching OpenZaak (see
+/// <c>scripts/openzaak-ui-up.sh</c>'s header comment). Logs the one signal that would actually
+/// distinguish "client built an empty body" from "something ate it after send": the declared
+/// Content-Length vs. the byte count actually read from the request right before it goes out.
+/// A mismatch here would prove client-side corruption; agreement would point downstream instead.
+/// </summary>
+public sealed class ZgwDiagnosticHandler(ILogger<ZgwDiagnosticHandler> logger) : DelegatingHandler
+{
+  protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+  {
+    if (request.Content is not null)
+    {
+      var bytes = await request.Content.ReadAsByteArrayAsync(cancellationToken);
+      logger.LogInformation(
+          "ZGW {Method} {Url}: Content-Length={ContentLength} actualBytes={Actual}",
+          request.Method, request.RequestUri, request.Content.Headers.ContentLength, bytes.Length);
+    }
+    return await base.SendAsync(request, cancellationToken);
+  }
+}