ci(acl): run the ACL integration test in CI inside the compose network (closes #55) (refs #46)

The hosted runner can't reach the stack's published ports (sibling containers),
so run the seed and the test as containers joined to the OpenZaak network,
reaching it by container IP — a single-label host like 'openzaak' isn't URL-valid
for OpenZaak's own URLValidator, but an IPv4 literal is. Code is delivered via
image build / docker cp (bind mounts don't reach the daemon either).

- infra/run-integration.sh: up -> wait healthy (docker inspect) -> seed published
  zaaktype (python container on the net) -> build + run the test image on the net
  -> always tear down. Plain docker primitives only (portable docker/podman).
- services/acl/Dockerfile.integration: builds + runs Acl.IntegrationTests; dotnet
  lives in the image, so the CI job needs only Docker (no setup-dotnet).
- make integration now delegates to the script; re-added the Gitea Actions job.

Supersedes the local-only gap documented earlier; #55 is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/run-integration.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+#
+# Run the ACL ↔ real-OpenZaak integration test (S-04a / #46) end to end.
+#
+# Everything that talks to OpenZaak runs *inside* the compose network and reaches
+# it by service name (http://openzaak:8000) — the hosted CI runner can't reach the
+# stack's published ports (sibling containers) and bind mounts don't reach the
+# daemon either (gitea-actions-gotchas.md §1/§5). So we use only plain docker
+# primitives (run / create / cp / build) — portable across docker compose (CI) and
+# podman-compose (local), exactly like infra/seed-config.sh. See ADR-0006.
+#
+# Steps: bring OpenZaak up → wait for it healthy → seed a PUBLISHED BIG zaaktype
+# (a seed container on the network) → build + run the test container on the network
+# → always tear down.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+root="$(cd "$here/.." && pwd)"
+OZ_COMPOSE="$here/openzaak/docker-compose.yml"
+
+cleanup() {
+  docker compose -f "$OZ_COMPOSE" down --volumes >/dev/null 2>&1 || true
+  docker volume rm -f rr-oz-config >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+echo ">> bringing OpenZaak up"
+bash "$here/seed-config.sh" oz
+docker compose -f "$OZ_COMPOSE" up -d
+
+echo ">> waiting for the OpenZaak API container to be healthy"
+# Match the API container under both docker compose (openzaak-openzaak-1) and
+# podman-compose (openzaak_openzaak_1) naming; the regex excludes oz-db / oz-redis.
+api=""
+for _ in $(seq 1 140); do
+  api="$(docker ps -q --filter 'name=openzaak[-_]openzaak' | head -1)"
+  if [ -n "$api" ]; then
+    status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$api" 2>/dev/null || true)"
+    [ "$status" = "healthy" ] && break
+  fi
+  sleep 3
+done
+[ -n "$api" ] || { echo "ERROR: OpenZaak API container never appeared" >&2; exit 1; }
+[ "${status:-}" = "healthy" ] || { echo "ERROR: OpenZaak not healthy (status=${status:-none})" >&2; exit 1; }
+
+# The network the API container is attached to — joined by the seed + test below.
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$api" | head -1)"
+# Reach OpenZaak by container IP, not by the service name. OpenZaak echoes its
+# request Host into the self-referential URLs it returns, then validates those URLs
+# with Django's URLValidator — which rejects a single-label host like `openzaak`
+# ("Voer een geldige URL in") while accepting an IPv4 literal (and `localhost`).
+oz_ip="$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$api")"
+oz_base="http://${oz_ip}:8000"
+echo ">> OpenZaak healthy on network $net at $oz_base"
+
+echo ">> seeding a published BIG zaaktype (OZ_PUBLISH=1, inside the network)"
+sid="$(docker create --network "$net" \
+  -e "OZ_BASE=$oz_base" -e OZ_PUBLISH=1 \
+  python:3-slim python /seed_catalogus.py)"
+docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed_catalogus.py"
+docker start -a "$sid"
+docker rm -f "$sid" >/dev/null
+
+echo ">> building the integration test image"
+docker build -f "$root/services/acl/Dockerfile.integration" -t rr-acl-integration "$root/services/acl"
+
+echo ">> running the integration tests (inside the network)"
+docker run --rm --network "$net" -e "OZ_BASE=$oz_base" rr-acl-integration