feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/projection-api/Projection.ReadModel/EfProjectionStore.cs

@@ -15,6 +15,7 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
             {
                 Id = entry.Id,
                 Status = entry.Status,
+                Reference = entry.Reference,
                 Bsn = entry.Bsn,
                 NaamPlaceholder = entry.NaamPlaceholder,
             });
@@ -22,6 +23,7 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
         else
         {
             row.Status = entry.Status;
+            row.Reference = entry.Reference;
             row.Bsn = entry.Bsn;
             row.NaamPlaceholder = entry.NaamPlaceholder;
         }
@@ -35,6 +37,6 @@ public sealed class EfProjectionStore(ProjectionDbContext db) : IProjectionStore
     public async Task<IReadOnlyList<RegisterEntry>> AllAsync(CancellationToken ct = default)
         => await db.RegisterEntries
             .OrderBy(r => r.Id)
-            .Select(r => new RegisterEntry(r.Id, r.Status, r.Bsn, r.NaamPlaceholder))
+            .Select(r => new RegisterEntry(r.Id, r.Status, Reference: r.Reference, Bsn: r.Bsn, NaamPlaceholder: r.NaamPlaceholder))
             .ToListAsync(ct);
 }