ci(domain): containerize, wire into compose, and verify end-to-end (refs #6)

Dockerfile (multi-stage, .NET 10) + .dockerignore for the BIG Domain Service; a
'domain' service in infra/docker-compose.yml (health-checked, depends on acl healthy
and flowable-init completed). run-domain-check.sh drives the full path against the up
stack — seed a published zaaktype, recreate the acl pointed at it (host-consistent),
POST /registrations, and assert the worker opens a zaak and records it. Wired as the
verify-domain Makefile target + a verify-stack CI step; domain added to WAIT_SVCS and
the log dump. seed_catalogus.py now emits a machine-readable ZAAKTYPE_URL line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Dockerfile

@@ -0,0 +1,34 @@
+# Multi-stage build for the BIG Domain Service (.NET 10).
+# Build context is services/domain (see infra/docker-compose.yml).
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+WORKDIR /src
+
+# Restore first (cached unless .csproj files change).
+COPY Big.Api/Big.Api.csproj Big.Api/
+COPY Big.Application/Big.Application.csproj Big.Application/
+COPY Big.Infrastructure/Big.Infrastructure.csproj Big.Infrastructure/
+COPY Big.Domain/Big.Domain.csproj Big.Domain/
+RUN dotnet restore Big.Api/Big.Api.csproj
+
+COPY Big.Api/ Big.Api/
+COPY Big.Application/ Big.Application/
+COPY Big.Infrastructure/ Big.Infrastructure/
+COPY Big.Domain/ Big.Domain/
+RUN dotnet publish Big.Api/Big.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
+
+FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /app/publish .
+
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -fsS http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["dotnet", "Big.Api.dll"]