feat(infra): Objecten publishes register events to NRC (refs #152)

Builds the four pieces ADR-0028 deliberately left absent, and turns
`NOTIFICATIONS_DISABLED` back off:

- `objecten-celery`, a worker on the Objecten image (mirrors `oz-celery`), plus
  `CELERY_BROKER_URL`/`RESULT_BACKEND` on objecten-redis db 1 (db 0 is the cache).
  Without it `notifications_api_common` queues the send and nothing ever ships it.
- An `nrc` service + `notifications_config` in Objecten's setup_configuration,
  reusing the `big-reference-seed` credential OpenZaak publishes with.
- The `objecten` kanaal in NRC's setup_configuration — the name is fixed by the
  Objects API (`NOTIFICATIONS_KANAAL`), and publishing to an unregistered kanaal is
  what the failing check reported first.
- `SITE_DOMAIN: objecten.local:8000` + an `objecten.local` network alias: NRC
  validates `hoofdObject`/`resourceUrl` with Django's URLValidator, which rejects a
  single-label host, so `objecten:8000` is refused with "Voer een geldige URL in."
  The alias keeps the dotted host resolvable so the URL still dereferences.

ADR-0029 records it; ADR-0028's ceiling now points there.

Makes `make verify-objecten-notifications` (dc9ca2c) pass.

infra/opennotificaties/setup_configuration/data.yaml

@@ -29,7 +29,9 @@ autorisaties_api_config_enable: true
 autorisaties_api:
   authorizations_api_service_identifier: openzaak-ac
 
-# 4. The kanaal OpenZaak publishes zaak events on.
+# 4. The kanalen publishers announce on: `zaken` (OpenZaak) and `objecten` (Objecten, S-19b-1).
+# Both authenticate with the big-reference-seed credential above, which OpenZaak's AC grants
+# heeft_alle_autorisaties — so no separate publisher authorization is needed for Objecten.
 notifications_kanalen_config_enable: true
 notifications_kanalen_config:
   items:
@@ -39,3 +41,11 @@ notifications_kanalen_config:
         - bronorganisatie
         - zaaktype
         - vertrouwelijkheidaanduiding
+    # 5. The kanaal Objecten publishes register-record events on (S-19b-1, ADR-0029). Its name is
+    # fixed by the Objects API itself (NOTIFICATIONS_KANAAL = "objecten"), not chosen here. The
+    # filter set matches what the Objects API sends as kenmerken, so an abonnement can narrow by
+    # objecttype rather than receiving every object write in the register.
+    - naam: objecten
+      documentatie_link: https://objects-and-objecttypes-api.readthedocs.io/
+      filters:
+        - object_type