S-19a · ACL writes the RegisterRecord to Objecten on approval (closes #149) (#151)

Closes #149.

**Outcome:** approving a registration now writes the canonical register record to the **Objecten** API as a `RegisterRecord` object, alongside the ZGW eindstatus. OpenZaak holds the process, Objecten holds the register (ADR-0028). The write goes through the ACL (§8.1) and is idempotent on the zaak id, so a replayed approval updates the existing object rather than creating a second one.

S-19 (#20) was split first (CLAUDE.md §13) — it bundled this with re-sourcing the read projection, which is now #150.

### What landed

- `IRegisterRecordGateway` + `RegisterRecord` in `Acl.Application`; `ObjectenGateway` in `Acl.Infrastructure` (static Token auth, CRS headers, objecttype resolved by name to its highest **published** version).
- `AclService.ApproveZaakAsync` writes the record after the eindstatus, keyed on the zaak UUID with the zaak's identificatie as reference.
- Compose wiring for both stacks; `ADR-0028`; demo note; PRD §15 out-of-scope line retired.

### Three things only a live stack found

Running the gateway against a real Objecten + Objecttypen pair while writing this turned up blockers CI would have hit after the fact:

1. **Objecten rejects an objecttype it has not been configured with**, by UUID — assigned at seed time by a one-shot that runs *after* Objecten's static setup_configuration. The UUID is now pinned on both sides.
2. **Objecten 500s on every write when its Notificaties config is absent** (`notifications_api_common` raises rather than skipping). Objecten → NRC has no broker, worker, kanaal or abonnement, so notifications are **disabled** rather than wired to drop every message; #150 turns them on for real.
3. **Objecttypen echoes the request Host into the objecttype `url`**, and Objecten only accepts the one matching its configured `api_root` — so the ACL must read Objecttypen at `http://objecttypen:8000`. This is why the new integration test only passes inside the compose network.

All three are recorded in ADR-0028.

### Verification

- `ObjectenGatewayIntegrationTests` (verify-acl, in-network): two writes for one id leave exactly one object with the second write's status. **Passing locally against live Objecten.**
- The **Playwright happy path** asserts, after the behandelaar approves, that Objecten holds exactly one `RegisterRecord` for *that* reference — missing, duplicated, or non-public-safe all fail.
- ACL mutation score **92.23%** (baseline 91.37%, break 90).
- `make lint` / `make unit` green locally; full-stack `make verify` runs in CI.

## Definition of Done

- [x] A linked Gitea issue exists (#149).
- [x] Failing test written and committed first.
- [x] Implementation makes the test pass.
- [x] Refactor commit follows if structure improved.
- [x] Conventional Commit messages referencing the issue (`refs #149`).
- [x] All Gitea Actions CI jobs green (run 684).
- [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (verify-stack step 1).
- [x] Docs touched — ADR-0028, demo note, PRD §15, BACKLOG.
- [x] ADR added: `docs/architecture/adr-0028-objecten-holds-the-register.md`.
- [x] Demo note appended to `docs/demo-script.md`.
- [x] Closed by the merging PR (`closes #149`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #151

docs/demo-script.md

@@ -5,6 +5,43 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-19a — approval writes the register record to Objecten (#149, ADR-0028)
+
+**Outcome:** approving a registration no longer only moves the ZGW zaak to its eindstatus — it also
+writes the canonical **register record** into the **Objecten** API. OpenZaak keeps the process,
+Objecten holds the register. The write goes through the ACL (§8.1) and is **idempotent**: replaying an
+approval updates the existing object instead of creating a second one.
+
+```bash
+# 1. Bring the stack up (Objecten, Objecttypen and the RegisterRecord objecttype come with it).
+make up
+#
+# 2. End-to-end: the walking-skeleton e2e submits, approves via the behandel portal, and then
+#    asserts Objecten holds exactly one RegisterRecord for *that* registration:
+make verify-e2e        # → "DigiD submit → … → behandelaar goedkeurt → public INGESCHREVEN"
+#
+# 3. The ACL integration test proves the same writes against a live Objecten (upsert stays one object):
+make verify-acl        # → "Writes a register record and updates it in place on a second write"
+#
+# 4. See it for yourself — every register record currently in Objecten:
+curl -s -H 'Authorization: Token 1234567890abcdef1234567890abcdef12345678' \
+     -H 'Accept-Crs: EPSG:4326' \
+     'http://localhost:8021/api/v2/objects' | python3 -m json.tool
+```
+
+Each object's `record.data` carries exactly `id`, `status`, `reference` — the schema forbids anything
+else (ADR-0027), so no personal data can reach the world-readable register even by mistake.
+
+**The path:** behandel portal → BFF → domain `BeoordeelRegistratie` → ACL `POST /statussen` → ZGW
+`resultaten` + `statussen` (the process), **then** ACL → Objecten `POST`/`PATCH /api/v2/objects` (the
+register). The objecttype URL is resolved by name from Objecttypen on first use, so nothing seed-time
+is pinned in config (ADR-0028, same reasoning as ADR-0021).
+
+**Not yet:** the public register still reads the NRC-derived projection — re-sourcing it from Objecten
+is S-19b (#150).
+
+---
+
 ## S-18c — RegisterRecord objecttype defined + registered (#141, ADR-0027)
 
 **Outcome:** a **RegisterRecord** objecttype with a **published** JSON schema is registered in the