feat(openzaak): one-command UI-OpenZaak bridge, real BSN fix, flake mitigation

scripts/openzaak-ui-up.sh brings up the root app and the OpenZaak harness
together, wires them onto one docker network, seeds the catalogus, grants
the container-alias zaaktype scope, and verifies a real aanvraag submitted
through the UI lands in OpenZaak.

Along the way: DocumentStore.DemoOwner was reusing the seeded doctor's
11-digit BIG-nummer as a stand-in BSN, which isn't a valid 9-digit BSN shape
— OpenZaak rejects it, breaking both submit's rol-creation step and the
citizen's own applications list under Zgw:Enabled=true. Fixed to a real
elfproef-valid BSN.

Also adds mitigation for a still-unexplained per-container flake (every
outbound ZGW POST fails as if the body were empty, for that container's
whole lifetime) that correlates with host memory pressure: the script now
warns when host swap is heavily used, and an opt-in ZgwDiagnosticHandler
(ZGW_DEBUG_HTTP=1) logs Content-Length vs. actual bytes sent so the next
reproduction can confirm or rule out client-side body corruption.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Zgw/ZgwDiagnosticHandler.cs

@@ -0,0 +1,25 @@
+namespace BigRegister.Api.Zgw;
+
+/// <summary>
+/// Opt-in only (wired in <c>Program.cs</c> behind <c>ZGW_DEBUG_HTTP=1</c>) — chases the
+/// still-unexplained flake where a freshly-(re)started `api` container has every outbound ZGW
+/// POST fail with what looks like an empty body reaching OpenZaak (see
+/// <c>scripts/openzaak-ui-up.sh</c>'s header comment). Logs the one signal that would actually
+/// distinguish "client built an empty body" from "something ate it after send": the declared
+/// Content-Length vs. the byte count actually read from the request right before it goes out.
+/// A mismatch here would prove client-side corruption; agreement would point downstream instead.
+/// </summary>
+public sealed class ZgwDiagnosticHandler(ILogger<ZgwDiagnosticHandler> logger) : DelegatingHandler
+{
+  protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+  {
+    if (request.Content is not null)
+    {
+      var bytes = await request.Content.ReadAsByteArrayAsync(cancellationToken);
+      logger.LogInformation(
+          "ZGW {Method} {Url}: Content-Length={ContentLength} actualBytes={Actual}",
+          request.Method, request.RequestUri, request.Content.Headers.ContentLength, bytes.Length);
+    }
+    return await base.SendAsync(request, cancellationToken);
+  }
+}