feat(infra): Objecten publishes register events to NRC (refs #152)

Builds the four pieces ADR-0028 deliberately left absent, and turns
`NOTIFICATIONS_DISABLED` back off:

- `objecten-celery`, a worker on the Objecten image (mirrors `oz-celery`), plus
  `CELERY_BROKER_URL`/`RESULT_BACKEND` on objecten-redis db 1 (db 0 is the cache).
  Without it `notifications_api_common` queues the send and nothing ever ships it.
- An `nrc` service + `notifications_config` in Objecten's setup_configuration,
  reusing the `big-reference-seed` credential OpenZaak publishes with.
- The `objecten` kanaal in NRC's setup_configuration — the name is fixed by the
  Objects API (`NOTIFICATIONS_KANAAL`), and publishing to an unregistered kanaal is
  what the failing check reported first.
- `SITE_DOMAIN: objecten.local:8000` + an `objecten.local` network alias: NRC
  validates `hoofdObject`/`resourceUrl` with Django's URLValidator, which rejects a
  single-label host, so `objecten:8000` is refused with "Voer een geldige URL in."
  The alias keeps the dotted host resolvable so the URL still dereferences.

ADR-0029 records it; ADR-0028's ceiling now points there.

Makes `make verify-objecten-notifications` (dc9ca2c) pass.

infra/docker-compose.yml

@@ -717,12 +717,21 @@ services:
       CACHE_AXES: objecten-redis:6379/0
       DISABLE_2FA: "true"
       OTEL_SDK_DISABLED: "true"
-      # S-19a: Objecten refuses every write while its Notificaties config is absent
-      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
-      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
-      # notifications off rather than fake a delivery path that silently drops every message.
-      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
-      NOTIFICATIONS_DISABLED: "true"
+      # NRC validates hoofdObject/resourceUrl with Django's URLValidator, which rejects a
+      # single-label host — so notifications built from `objecten:8000` are refused with
+      # "Voer een geldige URL in." SITE_DOMAIN fixes the host Objecten puts in its notifications
+      # (objects.utils.get_domain), and the `objecten.local` network alias below keeps that host
+      # resolvable in-network so a subscriber can actually fetch the record it points at (S-19b-2).
+      SITE_DOMAIN: objecten.local:8000
+      IS_HTTPS: "no"
+      CELERY_BROKER_URL: redis://objecten-redis:6379/1
+      CELERY_RESULT_BACKEND: redis://objecten-redis:6379/1
+      # Publish register-record events to NRC on the `objecten` kanaal (S-19b-1, ADR-0029). The NRC
+      # service + notifications_config are provisioned by setup_configuration
+      # (infra/objecten/setup_configuration/data.yaml), and objecten-celery below actually sends
+      # them — notifications_api_common only queues the task. See ADR-0028 for why S-19a left this
+      # off until all four pieces existed.
+      NOTIFICATIONS_DISABLED: "false"
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
@@ -750,6 +759,22 @@ services:
       start_period: 30s
     ports:
       - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks:
+      cg:
+        aliases:
+          - objecten.local
+
+  # The celery worker that actually delivers Objecten's notifications to NRC (S-19b-1, ADR-0029).
+  # notifications_api_common only schedules the send on transaction commit; without a worker the
+  # task sits in redis forever and every register write is silently undelivered. Mirrors oz-celery.
+  # No beat: Objecten is a publisher, not a subscriber — nrc-beat drains the delivery queue.
+  objecten-celery:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env
+    command: /celery_worker.sh
     depends_on:
       objecten-init:
         condition: service_completed_successfully