fix(infra): docker-compose.local self-seeds zaaktype, DMN + NRC abonnement (refs #110)

A fresh `make local` now completes the whole flow with no manual seeding, closing
the three S-B04 gaps in the host-browser stack:

- flowable-init also deploys diploma-eligibility.dmn (was BPMN-only), so completing
  WachtOpDocumenten routes through the DMN to Beoordelen instead of 404ing.
- a local-seed one-shot seeds + publishes the BIG zaaktype (server-assigned URL) and
  writes it to seed-env:/acl.env; the ACL sources it on startup (entrypoint override),
  since the UUID isn't knowable at compose-write time.
- an nrc-subscribe one-shot registers the `zaken` abonnement at the event-subscriber
  callback, so notifications reach the projection and the openbaar register.

Both one-shots reach OpenZaak/NRC by container IP (a single-label host fails their
Django URLValidator), mirroring the CI verify scripts. Asserted by `make verify-local`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/local/register-abonnement.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+"""Local-stack bootstrap (S-B04, #110, ADR-0020) — register the NRC abonnement.
+
+Runs as the `nrc-subscribe` init container of infra/docker-compose.local.yml. Registers an
+abonnement on the `zaken` kanaal pointing at the event-subscriber's /notifications callback, so
+OpenZaak's notifications (zaak create + status set) reach the projection — without this the openbaar
+(public) register stays empty. This is what infra/verify-notification-driver.py does for CI (minus
+the test zaak it also creates).
+
+The callback host is the event-subscriber's resolved **container IP**, not `event-subscriber`, because
+NRC validates callbackUrl with Django's URLValidator (a single-label host is rejected — same reason the
+zaaktype seed uses OpenZaak's IP). Idempotent + restart-safe: it removes any stale /notifications
+abonnement first, then registers one for the current IP. Stdlib only.
+
+Env: NRC_BASE, SINK_HOST, SINK_PORT, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
+"""
+import base64, hashlib, hmac, json, os, socket, sys, time, urllib.error, urllib.request
+
+NRC = os.environ.get("NRC_BASE", "http://nrc-web:8000").rstrip("/")
+SINK_HOST = os.environ.get("SINK_HOST", "event-subscriber")
+SINK_PORT = os.environ.get("SINK_PORT", "8080")
+SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer big-reference-notifications")
+CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
+SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
+
+
+def token():
+    b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
+    seg = (
+        b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
+        + b"."
+        + b64(json.dumps(
+            {"iss": CID, "iat": int(time.time()), "client_id": CID,
+             "user_id": "local-seed", "user_representation": "local-seed"},
+            separators=(",", ":")).encode())
+    )
+    return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
+
+
+def call(method, url, body=None):
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(url, data=data, method=method, headers={
+        "Authorization": "Bearer " + token(),
+        "Content-Type": "application/json", "Accept": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            raw = r.read()
+            return r.status, (json.loads(raw) if raw else None)
+    except urllib.error.HTTPError as e:
+        raw = e.read()
+        return e.code, (json.loads(raw) if raw else None)
+
+
+def main():
+    ip = socket.gethostbyname(SINK_HOST)
+    callback = f"http://{ip}:{SINK_PORT}/notifications"
+
+    # Restart-safe: drop any prior /notifications abonnement (its IP may be stale) before creating a
+    # fresh one for the current event-subscriber IP.
+    status, body = call("GET", f"{NRC}/api/v1/abonnement")
+    for ab in (body or []) if status == 200 else []:
+        if str(ab.get("callbackUrl", "")).endswith("/notifications"):
+            if ab.get("callbackUrl") == callback:
+                print(f"abonnement already current: {ab['url']}")
+                return
+            call("DELETE", ab["url"])
+            print(f"removed stale abonnement {ab['url']}")
+
+    status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
+        "callbackUrl": callback, "auth": SINK_AUTH,
+        "kanalen": [{"naam": "zaken", "filters": {}}]})
+    if status != 201:
+        sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
+    print(f"abonnement registered: {ab['url']} -> {callback}")
+
+
+if __name__ == "__main__":
+    main()