feat(acl): set and read the zaak identificatie as the citizen reference (refs #78)

The ACL now writes the domain registrationId as the zaak's identificatie on
POST /zaken, and exposes GET-through POST /zaken/reference to read a zaak's
identificatie back. Only the ACL touches ZGW (§8.1); the reference is the single
value shown on both the self-service confirmation and the openbaar register.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/acceptance/Steps/EenZaakOpenenSteps.cs

@@ -18,7 +18,7 @@ public sealed class EenZaakOpenenSteps
 
     [Given("a domain registration for BSN \"(.*)\"")]
     public void GivenADomainRegistrationForBsn(string bsn)
-        => _registration = new DomainRegistration(bsn);
+        => _registration = new DomainRegistration(bsn, "ACC-REF-1");
 
     [Given("the ACL is configured with these defaults:")]
     public void GivenTheAclIsConfiguredWithTheseDefaults(DataTable defaults)