feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Application/Notification.cs

@@ -24,10 +24,12 @@ public sealed record Notification(
     public bool IsZaakStatusSet =>
         Kanaal == "zaken" && Resource == "status" && Actie == "create";
 
-    /// <summary>The zaak UUID used as the projection key. For a status notification the resource URL is
-    /// the status, so the zaak comes from <c>hoofdObject</c> (which, for a zaak-create, equals the
-    /// resource URL) — see the NRC payload note.</summary>
-    public string ZaakId => (HoofdObject ?? ResourceUrl).Segments[^1].Trim('/');
+    /// <summary>The zaak URL this notification concerns — <c>hoofdObject</c> (the zaak) for a status
+    /// notification, else the resource URL (which, for a zaak-create, is the zaak).</summary>
+    public Uri ZaakUrl => HoofdObject ?? ResourceUrl;
+
+    /// <summary>The zaak UUID used as the projection key — the trailing segment of <see cref="ZaakUrl"/>.</summary>
+    public string ZaakId => ZaakUrl.Segments[^1].Trim('/');
 
     /// <summary>
     /// A deterministic dedup key. Open Notificaties carries no notification id and may