feat(openzaak): one-command UI-OpenZaak bridge, real BSN fix, flake mitigation

scripts/openzaak-ui-up.sh brings up the root app and the OpenZaak harness
together, wires them onto one docker network, seeds the catalogus, grants
the container-alias zaaktype scope, and verifies a real aanvraag submitted
through the UI lands in OpenZaak.

Along the way: DocumentStore.DemoOwner was reusing the seeded doctor's
11-digit BIG-nummer as a stand-in BSN, which isn't a valid 9-digit BSN shape
— OpenZaak rejects it, breaking both submit's rol-creation step and the
citizen's own applications list under Zgw:Enabled=true. Fixed to a real
elfproef-valid BSN.

Also adds mitigation for a still-unexplained per-container flake (every
outbound ZGW POST fails as if the body were empty, for that container's
whole lifetime) that correlates with host memory pressure: the script now
warns when host swap is heavily used, and an opt-in ZgwDiagnosticHandler
(ZGW_DEBUG_HTTP=1) logs Content-Length vs. actual bytes sent so the next
reproduction can confirm or rule out client-side body corruption.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -36,8 +36,16 @@ public sealed record AuditEntry(DateTimeOffset At, string Action, string Documen
 /// </summary>
 public static class DocumentStore
 {
-  /// The single seeded user (the demo has no real auth; ownership = this id).
-  public const string DemoOwner = "19012345601";
+  /// The single seeded user (the demo has no real auth; ownership = this id) — a real,
+  /// elfproef-valid 9-digit BSN (src/app/shared/kernel/bsn.ts's own checksum), distinct from
+  /// SeedData.Registration.BigNummer ("19012345601", 11 digits — the seeded doctor's BIG-nummer,
+  /// a different Dutch identifier scheme). Previously this constant reused that BigNummer value
+  /// as a stand-in BSN, which is invalid Dutch-BSN shape: harmless against the local store, but
+  /// a real OpenZaak instance rejects it outright — GET /api/v1/applications 500s (`inpBsn` query
+  /// filter validation) and every submit's rol-creation POST fails (`inpBsn` max_length) once
+  /// Zgw:Enabled=true. Not "111222333" or "999888777" — both already mean a different fixture
+  /// identity (the OpenZaak-harness/unit-test caller, and ApplicationTests' "other citizen").
+  public const string DemoOwner = "123456782";
 
   private static readonly object _gate = new();