feat(zgw): OpenZaak create-zaak, first write slice (WP-50)

Extends the IZaakSource seam (WP-49, read-only) with CreateZaak: submitting
an aanvraag now also registers a Zaak + Status + Rol in OpenZaak when
Zgw:Enabled=true, routed through the existing /applications/{id}/submit
endpoint with the FE response DTO unchanged (ADR-0001/ADR-0005 — the
endpoint never branches on the config flag itself, DI already picked the
implementation).

- ZgwOptions gains a Type→zaaktype-URL map + the two RSINs a Zaak needs.
- LocalZaakSource.CreateZaak is a pure passthrough of what the endpoint
  already computes locally (zero behaviour change for the offline default).
- OpenZaakZaakSource.CreateZaak POSTs the zaak (identificatie = the same
  local reference, so both stay in sync), resolves + POSTs the initial
  status and the initiator rol (BSN) via Catalogi lookups, and maps the
  result back into the submit response.
- Marked ponytail shortcuts: first-statustype/roltype-Catalogi-returns
  (no per-type config) and no compensating transaction on partial failure
  — both fine for a first slice against a demo backend.

Verified: full `npm run ci` green, zero api-client drift, 144/144 backend
tests (142 existing + 2 new stub-handler tests asserting the POST bodies
+ type→zaaktype mapping per the acceptance criteria).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/reference/architecture/0005-openzaak-behind-bff.md

@@ -64,6 +64,8 @@ up front — the migration stance ADR-0001 already prescribes.
 - **Shipped with this ADR (WP-49):** `IZaakSource` + `LocalZaakSource` (default) +
   `OpenZaakZaakSource` (config-gated), the `Zgw/` client (`ZgwOptions`, `ZgwTokenProvider`,
   `ZgwZaakMapper`), and the reference guide [openzaak-integration.md](../openzaak-integration.md).
-- **Deferred:** real inbound OIDC/JWT auth (still header-stubbed), create-zaak (WP-50),
-  Documenten/DRC upload + link (WP-51), Notificaties/NRC webhooks (WP-52), adding OpenZaak to
-  docker-compose.
+- **Also shipped (WP-50):** `IZaakSource.CreateZaak` — the first write. Submitting an aanvraag
+  now also creates a Zaak + Status + Rol in OpenZaak when `Zgw:Enabled=true`, routed through the
+  existing submit endpoint with zero DTO change (same seam, same anti-corruption boundary).
+- **Deferred:** real inbound OIDC/JWT auth (still header-stubbed), Documenten/DRC upload + link
+  (WP-51), Notificaties/NRC webhooks (WP-52), adding OpenZaak to docker-compose.