feat(openzaak): real secrets + TLS for the production OpenZaak harness (WP-55)

docker-compose.openzaak.prod.yml layers real SECRET_KEY/DB password/site
domain/allowed-hosts (all required, fail-fast via ${VAR:?...}) on top of the
WP-54 dev harness, switches Postgres off trust auth, and sets IS_HTTPS for a
front-facing reverse-proxy TLS setup. The ZGW client secret lives inside a
file setup_configuration reads rather than a compose env var, so it's
templated (data.prod.yaml.template, no secret) and rendered host-side via
render-prod-secrets.sh into a gitignored data.prod.yaml, mounted over the
container's dev data.yaml. ZgwOptions.cs already binds from IConfiguration,
so the BFF side needed no code change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/WP-63-aanvraag-status-lifecycle.md

@@ -26,7 +26,7 @@ read (this WP), the behandelportal needs it as the thing it advances (WP-65).
 - The DTO change is additive: the SSP's `pendingHerregistratie` boolean can be derived
   from the new status field (or kept as a computed convenience) so this ships with zero
   required FE behavior change — a pure backend + contract widening.
-- Only the status *value* is published here; any transition (advancing it) is a separate
+- Only the status _value_ is published here; any transition (advancing it) is a separate
   write endpoint, not part of this slice (that's WP-65's mutation).
 
 ## Files
@@ -60,7 +60,7 @@ dashboard still shows the same pending/approved states it does today.
 
 ## Out of scope
 
-Any endpoint that *advances* the status (WP-65); the behandelportal consuming it (WP-64).
+Any endpoint that _advances_ the status (WP-65); the behandelportal consuming it (WP-64).
 
 ## Risks