feat(openzaak): least-privilege client scopes (WP-57)

setup_configuration has no YAML field for granular autorisaties, so
bigregister-test now starts at heeft_alle_autorisaties: false (dev + prod
template) and bootstrap-catalogus.sh grants exactly the ztc/zrc scopes the
harness needs via the Django ORM, sidestepping the zero-scope
chicken-and-egg with the JWT-authenticated Autorisaties REST API.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/README.md

@@ -107,14 +107,24 @@ app change.
   **rolls back the whole create**) on any notified resource — see the compose file's comment.
 - `setup_configuration/data.yaml` — the declarative, scripted alternative to clicking through
   the Django admin (upstream's own documented `setup_configuration` CLI mechanism): creates the
-  one `bigregister-test` client (`heeft_alle_autorisaties: true` — this instance never exists
-  for anything but this harness, so there's no least-privilege boundary worth modeling).
+  one `bigregister-test` client with `heeft_alle_autorisaties: false` — this YAML mechanism
+  (`vng_api_common`'s `ApplicatieConfigurationModel`) has no field for granular scopes at all,
+  so the client starts with zero Autorisaties; `bootstrap-catalogus.sh` grants the exact ones
+  it needs (WP-57).
 - `bootstrap-catalogus.sh` — the business content (catalogus/zaaktype/zaak/…) `setup_configuration`
   has no YAML for; every field value here was checked against OpenZaak's own OpenAPI spec and a
   live run of this exact script, not guessed (two OpenZaak quirks it works around: a zaaktype
   needs ≥1 resultaattype and 2 statustypen before it can be published, and its
   `selectielijstklasse` and the zaaktype's `selectielijstProcestype` must reference the same
   `procesType` on the public VNG selectielijst API). Idempotent (WP-56) — see "Bring it up" above.
+  Also grants `bigregister-test`'s Autorisaties via `manage.py shell` (WP-57, see the script's
+  top comment): `ztc` scopes (`catalogi.lezen`/`catalogi.schrijven`, this script's own
+  content-creation needs) up front, `zrc` scopes (`zaken.aanmaken`/`zaken.bijwerken`/
+  `zaken.lezen`, scoped to the one zaaktype the BFF and this script both use) once that
+  zaaktype exists. No `documenten`/DRC grant — `Zgw:InformatieobjecttypeUrls` is empty in this
+  harness's `appsettings.json`, so `OpenZaakDocumentSource` isn't reachable here yet; add the
+  grant (scoped to a real `informatieobjecttype`, which this script would also need to seed)
+  when a later WP wires DRC content into this harness.
 - **Not here**: Documenten (DRC) / Notificaties (NRC) content — add if a later WP needs to prove
   those round-trips against a live instance too (WP-51/52 are fixture-tested today).
 - `docker-compose.openzaak.prod.yml` (WP-55) — production overrides layered on top of