feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55)

docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site
domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the
WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a
front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a
file setup_configuration reads rather than a compose env var, so it's
templated (data.prod.yaml.template, no secret) and rendered host-side via
render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the
container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration,
so the BFF side needed no code change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/setup_configuration/data.prod.yaml.template

@@ -0,0 +1,28 @@
+# Prod counterpart of data.yaml (WP-54's dev-only version, kept as-is for local iteration —
+# see docker-compose.openzaak.yml's own comment on why it hardcodes a client secret). This
+# template has no secret in it; render-prod-secrets.sh substitutes OPENZAAK_CLIENT_SECRET
+# into it to produce the gitignored data.prod.yaml that docker-compose.openzaak.prod.yml
+# mounts over the container's data.yaml.
+#
+# Least-privilege client scopes (heeft_alle_autorisaties: true below) are WP-57's job, not
+# this WP's — left matching the dev harness on purpose.
+sites_config_enable: true
+sites_config:
+  items:
+    - domain: ${OPENZAAK_SITE_DOMAIN}
+      name: OpenZaak (production)
+
+vng_api_common_credentials_config_enable: true
+vng_api_common_credentials:
+  items:
+    - identifier: ${OPENZAAK_CLIENT_ID}
+      secret: ${OPENZAAK_CLIENT_SECRET}
+
+vng_api_common_applicaties_config_enable: true
+vng_api_common_applicaties:
+  items:
+    - uuid: ${OPENZAAK_APPLICATIE_UUID}
+      client_ids:
+        - ${OPENZAAK_CLIENT_ID}
+      label: BIG-register BFF (production)
+      heeft_alle_autorisaties: true