feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

services/event-subscriber/EventSubscriber.Application/NotificationProjector.cs

@@ -5,17 +5,19 @@ namespace EventSubscriber.Application;
 /// out-of-order deliveries (CLAUDE.md §8.6): the notification log dedups, and the projection
 /// upsert is idempotent on the zaak id. Rebuilds the projection by replaying the log.
 /// </summary>
-public sealed class NotificationProjector(INotificationLog log, IProjectionStore store)
+public sealed class NotificationProjector(INotificationLog log, IProjectionStore store, IAclClient acl)
 {
     /// <summary>Handle one inbound notification. Reacts to a zaak being created (INGEDIEND) and a
-    /// status being set (INGESCHREVEN); ignores everything else.</summary>
+    /// status being set (INGESCHREVEN); ignores everything else. Enriches the row with the zaak's
+    /// reference via the ACL (§8.1) and records it so a rebuild needs no ZGW access (#78).</summary>
     public async Task HandleAsync(Notification notification, CancellationToken ct = default)
     {
         if (!notification.IsZaakCreated && !notification.IsZaakStatusSet)
             return;
 
+        var reference = await acl.GetZaakReferenceAsync(notification.ZaakUrl, ct);
         var recorded = new RecordedNotification(
-            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource);
+            notification.IdempotencyKey, notification.Actie, notification.ZaakId, notification.Resource, reference);
 
         // Atomic record-or-skip: a duplicate (or concurrent) delivery is recognised and dropped
         // before it touches the projection, so the projection stays a faithful derived artefact.
@@ -36,7 +38,8 @@ public sealed class NotificationProjector(INotificationLog log, IProjectionStore
     /// <summary>The projection row for an accepted notification: a status-set maps to INGESCHREVEN,
     /// a zaak-create to INGEDIEND. bsn/naam are deferred (ADR-0008).</summary>
     private static RegisterEntry ToEntry(RecordedNotification recorded)
-        => new(recorded.ZaakId, recorded.Resource == "status"
-            ? RegistrationStatus.Ingeschreven
-            : RegistrationStatus.Ingediend);
+        => new(
+            recorded.ZaakId,
+            recorded.Resource == "status" ? RegistrationStatus.Ingeschreven : RegistrationStatus.Ingediend,
+            Reference: recorded.Reference);
 }