S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -7,13 +7,15 @@ namespace EventSubscriber.Application;
 /// </summary>
 public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
 {
-    /// <summary>Handle one inbound notification. Ignores anything that is not a zaak-created event.</summary>
+    /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
+    /// status being set (INGESCHREVEN); ignores everything else.</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
-        if (!notification.IsZaakCreated)
+        if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
-        var recorded = new RecordedNotification(notification.IdempotencyKey, notification.Actie, notification.ZaakId);
+        var recorded = new RecordedNotification(
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -31,8 +33,10 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
             await store.UpsertAsync(ToEntry(recorded), ct);
     }
 
-    /// <summary>The minimal projection row for an accepted notification. A zaak-create maps to
-    /// INGEDIEND; bsn/naam are deferred (ADR-0008).</summary>
+    /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
+    /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, RegistrationStatus.Ingediend);
+        => new(recorded.ZaakId, recorded.Resource == "status"
+            ? RegistrationStatus.Ingeschreven
+            : RegistrationStatus.Ingediend);
 }