fix(ci): unbreak backend format, storybook-a11y, and e2e jobs

- backend: dotnet format the WP-51 migration (2-space indent, no BOM)
  to match .editorconfig — dotnet format --verify-no-changes was failing.
- storybook: stub FeatureFlagStore (WP-47) in shell/site-header stories
  alongside AccessStore, fixing NG0201 no-provider errors; bump the
  storybook-a11y container's memory cap 4g→6g (build-storybook +
  compodoc measured ~5.8GB peak RSS, leaving too little headroom).
- backend: fix a startup-breaking bug in the new (WP-52) POST
  /zgw/notificaties handler — it took ZgwOptions as a minimal-API
  parameter, which isn't registered in DI, so ASP.NET's endpoint-table
  build threw on every request once the route was registered (incl.
  /swagger, which is why Playwright's webServer health check timed
  out). Close over the existing `zgw` local instead.
- e2e: brief-v2.spec.ts's "Voorbeeld" button locator was ambiguous
  once a second "Voorbeeld met testwaarden" button existed (Playwright
  name matching is substring-based) — added `exact: true`. Also fixed
  the sent-letter preview flow to match app-letter-composer's actual
  behavior (single click → fetch, no in-page dialog, unlike
  app-behandel-scherm's), and fixed a watermark assertion that checked
  for the always-present `.preview-watermark` CSS class name instead
  of the conditionally-rendered "VOORBEELD" marker text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Zgw/NotificatieDto.cs

@@ -0,0 +1,19 @@
+using System.Text.Json.Serialization;
+
+namespace BigRegister.Api.Zgw;
+
+/// <summary>
+/// The Notificaties API (NRC) webhook body (WP-52) — the standard ZGW notification shape POSTed
+/// to a subscribed <c>abonnement</c>'s <c>callbackUrl</c> on every zaak event. Only
+/// <see cref="HoofdObject"/> (the zaak's URL — not PII) is read today, for the audit trail; the
+/// rest is parsed because it's the real payload shape a live OpenZaak actually sends, not
+/// because this endpoint acts on it yet.
+/// </summary>
+public sealed record NotificatieDto(
+    [property: JsonPropertyName("kanaal")] string Kanaal,
+    [property: JsonPropertyName("hoofdObject")] string HoofdObject,
+    [property: JsonPropertyName("resource")] string Resource,
+    [property: JsonPropertyName("resourceUrl")] string ResourceUrl,
+    [property: JsonPropertyName("actie")] string Actie,
+    [property: JsonPropertyName("aanmaakdatum")] DateTimeOffset Aanmaakdatum,
+    [property: JsonPropertyName("kenmerken")] Dictionary<string, string>? Kenmerken);

backend/src/BigRegister.Api/Zgw/ZgwOptions.cs

@@ -8,8 +8,9 @@ namespace BigRegister.Api.Zgw;
 ///
 /// The ZGW standard is FIVE separate services, each its own base URL — slice 1 (WP-49) only
 /// needed the Zaken API (ZRC) and, to resolve human labels for a zaaktype, the Catalogi API
-/// (ZTC). WP-50 (create-zaak) stayed on those two; WP-51 adds the Documenten API (DRC).
-/// BRC/NRC arrive with later slices (WP-52+).
+/// (ZTC). WP-50 (create-zaak) stayed on those two; WP-51 adds the Documenten API (DRC); WP-52
+/// adds the Notificaties API (NRC) — inbound only, see <see cref="NotificatieAuthorization"/>.
+/// BRC arrives with a later slice, if ever.
 /// </summary>
 public sealed class ZgwOptions
 {
@@ -52,4 +53,16 @@ public sealed class ZgwOptions
   /// URL (Catalogi), so create-document (WP-51) knows which type to register per category —
   /// the document analogue of <see cref="ZaaktypeUrls"/>.</summary>
   public Dictionary<string, string> InformatieobjecttypeUrls { get; init; } = new();
+
+  /// <summary>Notificaties API (NRC) base URL (WP-52) — documentation/provisioning only, no
+  /// code in this app calls it: subscribing an <c>abonnement</c> is a one-time out-of-band
+  /// step (see <c>openzaak-integration.md</c>), not something the BFF does at runtime.</summary>
+  public string NrcBaseUrl { get; init; } = "";
+
+  /// <summary>The exact <c>Authorization</c> header value NRC must send on every
+  /// <c>POST /zgw/notificaties</c> callback (WP-52) — a plain shared secret set into the
+  /// <c>abonnement</c>'s <c>auth</c> field when provisioning, not a JWT. Empty (the default)
+  /// means every notification is rejected — an unconfigured secret must never mean "accept
+  /// anything".</summary>
+  public string NotificatieAuthorization { get; init; } = "";
 }