feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Api/AclHttpClient.cs

@@ -0,0 +1,30 @@
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using EventSubscriber.Application;
+
+namespace EventSubscriber.Api;
+
+/// <summary>
+/// HTTP client to the ACL service. The subscriber enriches the projection with the zaak's reference
+/// (identificatie) by asking the ACL — the only code that may read ZGW (§8.1) — rather than reading
+/// OpenZaak itself (adr-proposal #78).
+/// </summary>
+public sealed class AclHttpClient(HttpClient http) : IAclClient
+{
+    public async Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(zaakUrl);
+
+        using var response = await http.PostAsJsonAsync(
+            new Uri(http.BaseAddress!, "zaken/reference"), new ReferenceRequest(zaakUrl.ToString()), ct);
+        response.EnsureSuccessStatusCode();
+
+        var body = await response.Content.ReadFromJsonAsync<ReferenceResponse>(ct)
+            ?? throw new InvalidOperationException("The ACL returned an empty reference response.");
+        return body.Reference;
+    }
+
+    private sealed record ReferenceRequest([property: JsonPropertyName("zaakUrl")] string ZaakUrl);
+
+    private sealed record ReferenceResponse([property: JsonPropertyName("reference")] string Reference);
+}

services/event-subscriber/EventSubscriber.Api/Program.cs

@@ -11,9 +11,15 @@ var connectionString = builder.Configuration.GetConnectionString("Projection")
 // this value (ADR-0007), so the webhook enforces it.
 var webhookToken = builder.Configuration["EventSubscriber:Webhook:AuthToken"]
     ?? throw new InvalidOperationException("Missing configuration 'EventSubscriber:Webhook:AuthToken'");
+// The ACL is the only code that may read ZGW (§8.1); the subscriber enriches the projection with the
+// zaak reference through it (adr-proposal #78).
+var aclBaseUrl = builder.Configuration["Acl:BaseUrl"]
+    ?? throw new InvalidOperationException("Missing configuration 'Acl:BaseUrl'");
 
 builder.Services.AddProjectionReadModel(connectionString);
 builder.Services.AddProjectionWriteSide();
+builder.Services.AddHttpClient<EventSubscriber.Application.IAclClient, EventSubscriber.Api.AclHttpClient>(
+    c => c.BaseAddress = new Uri(aclBaseUrl));
 
 var app = builder.Build();