feat(openzaak): one-command UI-OpenZaak bridge, real BSN fix, flake mitigation

scripts/openzaak-ui-up.sh brings up the root app and the OpenZaak harness
together, wires them onto one docker network, seeds the catalogus, grants
the container-alias zaaktype scope, and verifies a real aanvraag submitted
through the UI lands in OpenZaak.

Along the way: DocumentStore.DemoOwner was reusing the seeded doctor's
11-digit BIG-nummer as a stand-in BSN, which isn't a valid 9-digit BSN shape
— OpenZaak rejects it, breaking both submit's rol-creation step and the
citizen's own applications list under Zgw:Enabled=true. Fixed to a real
elfproef-valid BSN.

Also adds mitigation for a still-unexplained per-container flake (every
outbound ZGW POST fails as if the body were empty, for that container's
whole lifetime) that correlates with host memory pressure: the script now
warns when host swap is heavily used, and an opt-in ZgwDiagnosticHandler
(ZGW_DEBUG_HTTP=1) logs Content-Length vs. actual bytes sent so the next
reproduction can confirm or rule out client-side body corruption.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -61,9 +61,18 @@ if (zgw.Enabled)
   // WP-60: a bounded client timeout matters once ZgwHttpClient retries — without one, the
   // sources' sync-over-async call (no CancellationToken threaded through) could block a
   // thread-pool thread for HttpClient's 100s default times 3 attempts.
-  builder.Services.AddHttpClient<IZaakSource, OpenZaakZaakSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+  var zaakClientBuilder = builder.Services.AddHttpClient<IZaakSource, OpenZaakZaakSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
   // WP-51: the documents (Documenten API / DRC) seam — same pattern as IZaakSource above.
-  builder.Services.AddHttpClient<IDocumentSource, OpenZaakDocumentSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+  var documentClientBuilder = builder.Services.AddHttpClient<IDocumentSource, OpenZaakDocumentSource>(c => c.Timeout = TimeSpan.FromSeconds(15));
+
+  // Opt-in diagnostic for the still-unexplained per-container flake (see
+  // scripts/openzaak-ui-up.sh's header comment) — off by default, zero cost unless set.
+  if (Environment.GetEnvironmentVariable("ZGW_DEBUG_HTTP") == "1")
+  {
+    builder.Services.AddTransient<ZgwDiagnosticHandler>();
+    zaakClientBuilder.AddHttpMessageHandler<ZgwDiagnosticHandler>();
+    documentClientBuilder.AddHttpMessageHandler<ZgwDiagnosticHandler>();
+  }
 }
 else
 {