feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/projection-api/Projection.ReadModel/ProjectionDbContext.cs

@@ -24,6 +24,7 @@ public sealed class ProjectionDbContext(DbContextOptions<ProjectionDbContext> op
             e.HasKey(r => r.Id);
             e.Property(r => r.Id).HasColumnName("id");
             e.Property(r => r.Status).HasColumnName("status").IsRequired();
+            e.Property(r => r.Reference).HasColumnName("reference");
             e.Property(r => r.Bsn).HasColumnName("bsn");
             e.Property(r => r.NaamPlaceholder).HasColumnName("naam_placeholder");
         });
@@ -36,6 +37,7 @@ public sealed class ProjectionDbContext(DbContextOptions<ProjectionDbContext> op
             e.Property(r => r.Actie).HasColumnName("actie").IsRequired();
             e.Property(r => r.ZaakId).HasColumnName("zaak_id").IsRequired();
             e.Property(r => r.Resource).HasColumnName("resource").IsRequired();
+            e.Property(r => r.Reference).HasColumnName("reference");
             e.Property(r => r.ReceivedAt).HasColumnName("received_at");
         });
     }
@@ -46,6 +48,10 @@ public sealed class RegisterEntryRow
 {
     public required string Id { get; set; }
     public required string Status { get; set; }
+
+    /// <summary>The citizen-facing reference (the zaak's identificatie) — matches the submit confirmation (#78).</summary>
+    public string? Reference { get; set; }
+
     public string? Bsn { get; set; }
     public string? NaamPlaceholder { get; set; }
 }
@@ -61,5 +67,8 @@ public sealed class ProcessedNotificationRow
     /// the right status without reading OpenZaak (S-09b).</summary>
     public required string Resource { get; set; }
 
+    /// <summary>The zaak reference (identificatie), retained so a rebuild reprojects it without the ACL (#78).</summary>
+    public string? Reference { get; set; }
+
     public DateTimeOffset ReceivedAt { get; set; }
 }