feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

services/acl/Acl.Tests/AclServiceTests.cs

@@ -22,6 +22,14 @@ public class AclServiceTests
             Approved = (zaakUrl, zaaktypeUrl, datumStatusGezet);
             return Task.CompletedTask;
         }
+
+        public Uri? ReadReferenceFor;
+
+        public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
+        {
+            ReadReferenceFor = zaakUrl;
+            return Task.FromResult("REG-FROM-ZAAK");
+        }
     }
 
     private static AclDefaults Defaults() => new()
@@ -50,7 +58,7 @@ public class AclServiceTests
         };
         var service = new AclService(gateway, defaults, new FixedClock(new DateOnly(2026, 6, 4)));
 
-        var url = await service.OpenZaakAsync(new DomainRegistration("123456782"));
+        var url = await service.OpenZaakAsync(new DomainRegistration("123456782", "reg-77"));
 
         Assert.Equal(gateway.Result, url);
         var req = Assert.IsType<ZaakRequest>(gateway.Captured);
@@ -59,6 +67,8 @@ public class AclServiceTests
         Assert.Equal("openbaar", req.Vertrouwelijkheidaanduiding);
         Assert.Equal(defaults.ZaaktypeUrl, req.Zaaktype);
         Assert.Equal(new DateOnly(2026, 6, 4), req.Startdatum);
+        // The registration reference becomes the zaak identificatie (#78).
+        Assert.Equal("reg-77", req.Identificatie);
     }
 
     [Fact]
@@ -103,4 +113,27 @@ public class AclServiceTests
         await Assert.ThrowsAsync<ArgumentNullException>(() => service.ApproveZaakAsync(null!));
         Assert.Null(gateway.Approved);
     }
+
+    [Fact]
+    public async Task Reading_a_zaak_reference_returns_the_zaaks_identificatie()
+    {
+        var gateway = new FakeGateway();
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
+        var zaak = new Uri("http://openzaak/zaken/api/v1/zaken/abc");
+
+        var reference = await service.GetZaakReferenceAsync(zaak);
+
+        Assert.Equal("REG-FROM-ZAAK", reference);
+        Assert.Equal(zaak, gateway.ReadReferenceFor);
+    }
+
+    [Fact]
+    public async Task Reading_a_null_zaak_reference_is_rejected()
+    {
+        var gateway = new FakeGateway();
+        var service = new AclService(gateway, Defaults(), new FixedClock(new DateOnly(2026, 6, 4)));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetZaakReferenceAsync(null!));
+        Assert.Null(gateway.ReadReferenceFor);
+    }
 }