feat(infra): wire OpenZaak → Open Notificaties notifications (refs #56)

Completes the S-01-c wiring so a zaak created in OpenZaak is published to NRC:

- OpenZaak: a zgw_consumers 'nrc' service + notifications_config (setup_configuration),
  publishing as big-reference-seed. NOTIFICATIONS_DISABLED stays true for OpenZaak-only
  bring-ups (OZ_NOTIFICATIONS_DISABLED) so the ACL integration test doesn't 500; the
  full/local stacks and stack-up set it false.
- NRC: the JWT credential, an 'ac' service + autorisaties_api delegation to OpenZaak's
  Autorisaties API, and the 'zaken' kanaal. nrc-init now runs setup_configuration; its
  data.yaml is delivered via the rr-nrc-config volume (seed-config.sh nrc), mirroring oz.
- nrc-beat added to every stack: NRC accepts a notification then drains it via a
  scheduled execute_notifications task — without beat, nothing is delivered. Interval 5s.

Applied across the standalone, full, and local-bind-mount composes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/opennotificaties/docker-compose.yml

@@ -52,11 +52,18 @@ services:
       OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-    # Migrations only for now. No setup_configuration steps are enabled yet (the
-    # OZ<->NRC notification wiring lands in S-06), and NRC's `setup_configuration`
-    # aborts with "No steps enabled" on the empty data.yaml — so we run `migrate`
-    # directly instead of /setup_configuration.sh. See data.yaml and ADR-0002.
-    command: ["sh", "-c", "/wait_for_db.sh && OTEL_SDK_DISABLED=True python src/manage.py migrate"]
+      RUN_SETUP_CONFIG: "true"
+      # Delivery cadence: nrc-beat fires `execute_notifications` this often to drain
+      # scheduled notifications to subscribers. Upstream default is 20s; 5s keeps the
+      # walking-skeleton + the verify smoke responsive.
+      NOTIFICATION_SEC_INTERVAL: "5"
+    # Runs migrations + setup_configuration (S-01-c): the JWT credential, the
+    # Autorisaties-API delegation, and the `zaken` kanaal that let OpenZaak publish
+    # notifications. data.yaml is streamed into this external volume by
+    # infra/seed-config.sh (same pattern as oz-init). See data.yaml + ADR-0006.
+    command: /setup_configuration.sh
+    volumes:
+      - nrc-config:/app/setup_configuration:ro
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -89,8 +96,25 @@ services:
         condition: service_completed_successfully
     networks: [cg]
 
+  # Celery beat: periodically fires `execute_notifications`, which drains the
+  # ScheduledNotification rows the API creates on publish and hands them to the
+  # worker for delivery. Without beat, notifications are accepted but never
+  # delivered to subscribers — so it is required, not optional. See ADR-0007.
+  nrc-beat:
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
+    environment: *nrc-env
+    command: /celery_beat.sh
+    depends_on:
+      nrc-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
 volumes:
   nrc-db:
+  # populated out-of-band by infra/seed-config.sh (docker cp) — see that script.
+  nrc-config:
+    external: true
+    name: rr-nrc-config
 
 networks:
   cg: