feat(acl): resolve zaaktype + informatieobjecttype by business key, not a pinned URL (refs #113)

The ACL now discovers its BIG zaaktype (by identificatie) and diploma
informatieobjecttype (by omschrijving) from OpenZaak's Catalogi API, instead of
being handed server-assigned URLs in config. A CachedZaaktypeCatalog resolves
lazily on first use and caches (success only, so a pre-publish miss is retried);
AclDefaults now carries ZaaktypeIdentificatie/InformatieobjecttypeOmschrijving.
Clear errors replace the opaque placeholder-URL 400. Unit tests cover the
resolver (resolve/cache/retry-on-failure) and the gateway lookups (match/miss).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Application/AclDefaults.cs

@@ -6,9 +6,12 @@ public sealed class AclDefaults
     public required string Bronorganisatie { get; init; }
     public required string VerantwoordelijkeOrganisatie { get; init; }
     public required string Vertrouwelijkheidaanduiding { get; init; }
-    public required Uri ZaaktypeUrl { get; init; }
 
-    /// <summary>The informatieobjecttype an uploaded diploma is filed under (S-10b). Seeded in the
-    /// catalogus and injected like <see cref="ZaaktypeUrl"/>.</summary>
-    public required Uri InformatieobjecttypeUrl { get; init; }
+    /// <summary>The BIG zaaktype's stable business key. The ACL resolves the (server-assigned) zaaktype
+    /// URL from this via the Catalogi API instead of being handed a pinned URL (S-27, ADR-0021).</summary>
+    public required string ZaaktypeIdentificatie { get; init; }
+
+    /// <summary>The omschrijving of the informatieobjecttype an uploaded diploma is filed under (S-10b);
+    /// resolved to a URL by the Catalogi API, like <see cref="ZaaktypeIdentificatie"/>.</summary>
+    public required string InformatieobjecttypeOmschrijving { get; init; }
 }