feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

apps/openbaar/src/app/register/register-page.html

@@ -43,7 +43,7 @@
         <tbody>
           @for (entry of entries(); track entry.id) {
             <tr>
-              <td>{{ entry.id }}</td>
+              <td>{{ entry.reference }}</td>
               <td>{{ entry.status }}</td>
             </tr>
           }

apps/openbaar/src/app/register/register-page.spec.ts

@@ -5,8 +5,8 @@ import { axe } from 'vitest-axe';
 import { RegisterPage } from './register-page';
 
 const sample: OpenbaarEntry[] = [
-  { id: 'zaak-abc', status: 'INGEDIEND' },
-  { id: 'zaak-def', status: 'INGESCHREVEN' },
+  { id: 'zaak-abc', status: 'INGEDIEND', reference: 'REG-abc' },
+  { id: 'zaak-def', status: 'INGESCHREVEN', reference: 'REG-def' },
 ];
 
 function providers(get = vi.fn().mockReturnValue(of(sample))) {
@@ -22,9 +22,11 @@ describe('RegisterPage', () => {
     await render(RegisterPage, { providers: providers(get).providers });
 
     expect(get).toHaveBeenCalled();
-    expect(await screen.findByText(/zaak-abc/)).toBeTruthy();
+    // The Referentie column shows the citizen's reference (matches the submit confirmation, #78),
+    // not the internal zaak id.
+    expect(await screen.findByText(/REG-abc/)).toBeTruthy();
     expect(screen.getByText(/INGEDIEND/)).toBeTruthy();
-    expect(screen.getByText(/zaak-def/)).toBeTruthy();
+    expect(screen.getByText(/REG-def/)).toBeTruthy();
   });
 
   it('searches by the entered term', async () => {