feat(acl): set and read the zaak identificatie as the citizen reference (refs #78)

The ACL now writes the domain registrationId as the zaak's identificatie on
POST /zaken, and exposes GET-through POST /zaken/reference to read a zaak's
identificatie back. Only the ACL touches ZGW (§8.1); the reference is the single
value shown on both the self-service confirmation and the openbaar register.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Tests/OpenZaakGatewayTests.cs

@@ -22,7 +22,7 @@ public class OpenZaakGatewayTests
 
     private static ZaakRequest SampleRequest() => new(
         "517439943", "517439943", "openbaar",
-        new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4));
+        new("http://openzaak/catalogi/api/v1/zaaktypen/big"), new DateOnly(2026, 6, 4), "REG-REF-1");
 
     private static StubHandler Created(out RequestCapture capture)
     {
@@ -67,6 +67,8 @@ public class OpenZaakGatewayTests
         Assert.Contains("\"vertrouwelijkheidaanduiding\":\"openbaar\"", capture.Body);
         Assert.Contains("\"startdatum\":\"2026-06-04\"", capture.Body);
         Assert.Contains("\"zaaktype\":\"http://openzaak/catalogi/api/v1/zaaktypen/big\"", capture.Body);
+        // The registration reference is set as the zaak identificatie (#78).
+        Assert.Contains("\"identificatie\":\"REG-REF-1\"", capture.Body);
     }
 
     [Fact]
@@ -357,6 +359,61 @@ public class OpenZaakGatewayTests
         Assert.Equal(4, rec.Requests.Count);
     }
 
+    [Fact]
+    public async Task Reading_a_zaak_returns_its_identificatie_with_bearer_and_crs()
+    {
+        RequestCapture? capture = null;
+        var handler = new StubHandler(req =>
+        {
+            capture = new RequestCapture { Seen = req };
+            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = JsonContent.Create(new { identificatie = "REG-XYZ", url = ZaakUrl }),
+            });
+        });
+
+        var reference = await Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl));
+
+        Assert.Equal("REG-XYZ", reference);
+        Assert.Equal(HttpMethod.Get, capture!.Seen!.Method);
+        Assert.Equal(ZaakUrl, capture.Seen.RequestUri!.ToString());
+        Assert.Equal("Bearer", capture.Seen.Headers.Authorization!.Scheme);
+        Assert.Equal("EPSG:4326", Assert.Single(capture.Seen.Headers.GetValues("Accept-Crs")));
+    }
+
+    [Fact]
+    public async Task Reading_a_zaak_throws_when_openzaak_rejects_it()
+    {
+        var handler = new StubHandler(_ =>
+            Task.FromResult(new HttpResponseMessage(HttpStatusCode.NotFound) { Content = new StringContent("nope") }));
+
+        var ex = await Assert.ThrowsAsync<HttpRequestException>(
+            () => Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl)));
+        Assert.Contains("Reading the zaak", ex.Message);
+    }
+
+    [Fact]
+    public async Task Reading_a_zaak_throws_when_openzaak_returns_an_empty_body()
+    {
+        var handler = new StubHandler(_ =>
+            Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent("null", System.Text.Encoding.UTF8, "application/json"),
+            }));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => Gateway(handler).GetZaakIdentificatieAsync(new Uri(ZaakUrl)));
+        Assert.Contains("empty zaak response", ex.Message);
+    }
+
+    [Fact]
+    public async Task Reading_a_null_zaak_is_rejected()
+    {
+        var handler = new StubHandler(_ => throw new InvalidOperationException("should not be sent"));
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => Gateway(handler).GetZaakIdentificatieAsync(null!));
+    }
+
     [Fact]
     public async Task Approving_rejects_a_null_zaak_or_zaaktype()
     {