S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -11,14 +11,23 @@ public sealed record Notification(
     string Kanaal,
     string Resource,
     string Actie,
-    Uri ResourceUrl)
+    Uri ResourceUrl,
+    Uri? HoofdObject = null)
 {
-    /// <summary>The only event the walking-skeleton projection reacts to: a zaak being created.</summary>
+    /// <summary>A zaak being created — projected as INGEDIEND.</summary>
     public bool IsZaakCreated =>
         Kanaal == "zaken" && Resource == "zaak" && Actie == "create";
 
-    /// <summary>The zaak UUID — the trailing path segment of the resource URL — used as the projection key.</summary>
-    public string ZaakId => ResourceUrl.Segments[^1].Trim('/');
+    /// <summary>A status being set on a zaak — the approval, projected as INGESCHREVEN (S-09b). In the
+    /// walking skeleton the only status ever set after creation is the approval, and the subscriber may
+    /// not read OpenZaak (§8.1), so any status-create is taken as the approval.</summary>
+    public bool IsZaakStatusSet =>
+        Kanaal == "zaken" && Resource == "status" && Actie == "create";
+
+    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
+    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
+    /// resource URL) — see the NRC payload note.</summary>
+    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -7,13 +7,15 @@ namespace EventSubscriber.Application;
 /// </summary>
 public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
 {
-    /// <summary>Handle one inbound notification. Ignores anything that is not a zaak-created event.</summary>
+    /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
+    /// status being set (INGESCHREVEN); ignores everything else.</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
-        if (!notification.IsZaakCreated)
+        if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
-        var recorded = new RecordedNotification(notification.IdempotencyKey, notification.Actie, notification.ZaakId);
+        var recorded = new RecordedNotification(
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -31,8 +33,10 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
             await store.UpsertAsync(ToEntry(recorded), ct);
     }
 
-    /// <summary>The minimal projection row for an accepted notification. A zaak-create maps to
-    /// INGEDIEND; bsn/naam are deferred (ADR-0008).</summary>
+    /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
+    /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, RegistrationStatus.Ingediend);
+        => new(recorded.ZaakId, recorded.Resource == "status"
+            ? RegistrationStatus.Ingeschreven
+            : RegistrationStatus.Ingediend);
 }

services/event-subscriber/EventSubscriber.Application/Ports.cs

@@ -19,8 +19,10 @@ public interface INotificationLog
     Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default);
 }
 
-/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its projection row.</summary>
-public sealed record RecordedNotification(string Key, string Actie, string ZaakId);
+/// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its
+/// projection row — including the ZGW <c>resource</c>, which distinguishes a zaak-create (INGEDIEND)
+/// from a status-set (INGESCHREVEN) so a rebuild reproduces the right status.</summary>
+public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource);
 
 /// <summary>The read projection store. Owned by the projection bounded context (ADR-0008); the
 /// subscriber writes to it and the projection-api reads it.</summary>

services/event-subscriber/EventSubscriber.Application/RegisterEntry.cs

@@ -17,4 +17,7 @@ public static class RegistrationStatus
 {
     /// <summary>A zaak has been created; the registration is submitted.</summary>
     public const string Ingediend = "INGEDIEND";
+
+    /// <summary>The registration has been approved and entered in the register (S-09b).</summary>
+    public const string Ingeschreven = "INGESCHREVEN";
 }