ci: cap storybook-a11y resources + document the ACL learnings

- test-storybook:ci gets --maxWorkers=2 so the Jest runner stops spawning one
  headless Chromium per core and OOM-ing the Gitea runner host (the root cause).
- storybook-a11y job gains a container resource ceiling (--cpus=2 --memory=4g) as
  a belt-and-suspenders guardrail; noted it needs a docker-mode act_runner.
- openzaak-integration.md: add "Anti-corruption layer — two nested boundaries"
  teaching section (BFF ACL vs upstreams + FE ACL vs BFF, and the principles).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -46,6 +46,14 @@ jobs:
   storybook-a11y:
     # Axe runs against every story in the static build; a violation fails the build.
     runs-on: ubuntu-latest
+    # Hard resource ceiling so a runaway test-storybook (one headless Chromium per Jest
+    # worker) can't OOM the runner host — it fails its own container instead. The real cap
+    # is `--maxWorkers=2` in test-storybook:ci; this is the belt-and-suspenders guardrail.
+    # NB: requires the Gitea act_runner to allow container jobs (docker mode). If the runner
+    # is host-only, drop this `container:` block and rely on the worker cap alone.
+    container:
+      image: node:24-bookworm
+      options: --cpus=2 --memory=4g --memory-swap=4g
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4