feat(infra): Objecten API up in compose, wired to Objecttypen (refs #140)

Stands up the upstream Maykin Objecten API in the stack — own PostGIS DB
+ redis, an -init that runs setup_configuration from the external config
volume (migrate + provision a static token + register the Objecttypen API
as a trusted service), and a health-checked web on host :8021. Objecten's
setup_configuration registers Objecttypen (api_type orc, api_key auth with
the S-18a dev token) so an object can reference its objecttype.

Same verbatim-image + seed-config pattern as S-18a. Wired into WAIT_SVCS,
CFG_VOLS, the SEED invocations, seed-config.sh, and the CI log-dump. Pinned
objects-api 3.4.0 (nearest release to objecttypes-api 3.4.2).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -635,6 +635,76 @@ services:
         condition: service_completed_successfully
     networks: [cg]
 
+  # ── Objecten API (S-18b) — upstream Maykin image, verbatim ─────────────────
+  # The authoritative object store. Same shape as Objecttypen (own DB + redis, an `-init` that runs
+  # setup_configuration from the external config volume, a health-checked web). Two differences: the
+  # DB is PostGIS (objects carry geometry), and setup_configuration registers the Objecttypen API
+  # (S-18a) as a trusted service so an object can reference its objecttype.
+  objecten-db:
+    image: docker.io/postgis/postgis:17-3.5
+    environment:
+      POSTGRES_USER: objects
+      POSTGRES_PASSWORD: objects
+      POSTGRES_DB: objects
+    volumes:
+      - objecten-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U objects"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  objecten-redis:
+    image: docker.io/library/redis:7
+    networks: [cg]
+
+  objecten-init:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: &objecten-env
+      DJANGO_SETTINGS_MODULE: objects.conf.docker
+      SECRET_KEY: ${OBJECTS_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: objecten-db
+      DB_NAME: objects
+      DB_USER: objects
+      DB_PASSWORD: objects
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: objecten-redis:6379/0
+      CACHE_AXES: objecten-redis:6379/0
+      DISABLE_2FA: "true"
+      OTEL_SDK_DISABLED: "true"
+      RUN_SETUP_CONFIG: "true"
+    command: /setup_configuration.sh
+    # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
+    volumes:
+      - objecten-config:/app/setup_configuration:ro
+    depends_on:
+      objecten-db:
+        condition: service_healthy
+      objecten-redis:
+        condition: service_started
+      # Objecten's setup_configuration registers the Objecttypen service; that service only needs to
+      # exist as config, but wait for Objecttypen to be up so the register is meaningful end to end.
+      objecttypen:
+        condition: service_healthy
+    networks: [cg]
+
+  objecten:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── Observability backplane (S-16a, ADR-0023) ──────────────────────────────
   # Grafana-native stack: Tempo ingests OTLP traces (the .NET services export
   # straight to it — no collector hop, S-16b), Prometheus scrapes service
@@ -685,6 +755,7 @@ volumes:
   flowable-db:
   projection-db:
   objecttypen-db:
+  objecten-db:
   # Config volumes — created and populated out-of-band by infra/seed-config.sh
   # (docker cp), because bind mounts don't reach sibling containers on the CI
   # runner. `external` keeps the names deterministic; the seed step manages them.
@@ -703,6 +774,9 @@ volumes:
   objecttypen-config:
     external: true
     name: rr-objecttypen-config
+  objecten-config:
+    external: true
+    name: rr-objecten-config
 
 networks:
   cg: