S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

docs/demo-script.md

@@ -195,5 +195,35 @@ curl -fsS http://localhost:8140/openbaar/register | jq   # same public-safe view
 # → [ { "id": "<zaak-uuid>", "status": "INGEDIEND" } ]
 ```
 
-> The register shows `INGEDIEND` entries today; the approval transition to a terminal status
-> (e.g. `INGESCHREVEN`) lands with the approval flow (S-09b, #75).
+> The register shows `INGEDIEND` on submit; approval flips it to `INGESCHREVEN` — see S-09b below.
+
+---
+
+## S-09b — Approval flow (public visibility flips to INGESCHREVEN)
+
+**Outcome:** a behandelaar approves a submitted registration via a temporary admin endpoint (no
+behandel-portal yet — S-12). The approval sets the zaak's final status through the ACL, which flows
+back to the projection over NRC, and the openbaar register then shows the entry as `INGESCHREVEN`.
+
+**The path:** `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW
+`/statussen`) → OpenZaak → NRC → Event Subscriber projects `INGESCHREVEN` → openbaar register.
+
+```bash
+# 1. Full stack up, then drive submit → public INGEDIEND → approve → public INGESCHREVEN:
+make up
+make verify-e2e
+
+# 2. Or by hand: submit (as in S-09), note the reference, then approve it.
+#    The zaak is opened off the request path, so approve once GET shows a zaakUrl.
+ref="<registration-reference-from-the-confirmation>"
+curl -fsS http://localhost:8130/registrations/$ref | jq       # domain (host port 8130): wait for .zaakUrl
+curl -fsS -X POST http://localhost:8130/registrations/$ref/approve -i   # → 204 No Content
+
+# 3. The public register now shows the entry as approved.
+curl -fsS http://localhost:8140/openbaar/register | jq
+# → [ { "id": "<zaak-uuid>", "status": "INGESCHREVEN" } ]
+```
+
+> **End of walking skeleton** (S-09 + S-09b): submit → process → projection → public visibility, from
+> INGEDIEND through approval to INGESCHREVEN. The subscriber takes any post-creation status-set as the
+> approval (ADR-0011) — a walking-skeleton assumption that tightens when more transitions arrive (S-12+).