arch(bff): ADR-0010 BFF OIDC validation + downstream boundaries (refs #8, #63)

The BFF is the portals' only backend (§8.3): it validates Keycloak digid-realm
JWTs on POST /self-service/registrations (extracting bsn → domain), leaves
GET /openbaar/register anonymous (public lookup, S-09), and fans out to the
domain and projection over typed HTTP clients. Tests mint tokens with a test
signing key; real Keycloak validation is a live-stack verify-bff check. Records
the container OIDC issuer-mismatch wrinkle. OpenAPI is generated + committed for
the S-08 client.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mkdocs.yml

@@ -31,6 +31,7 @@ nav:
       - "ADR-0007: OpenZaak → NRC notification wiring": architecture/adr-0007-notification-wiring.md
       - "ADR-0008: Read projection store": architecture/adr-0008-read-projection-store.md
       - "ADR-0009: External-task job worker": architecture/adr-0009-external-task-job-worker.md
+      - "ADR-0010: BFF OIDC validation": architecture/adr-0010-bff-oidc.md
   - Working in Gitea: gitea-workflow.md
   - Demo script: demo-script.md
   - Runbooks: