feat(zgw): finish WP-52 OpenZaak Notificaties (NRC) webhook slice

Endpoint/DTO/options landed already in c4dd846; this closes the loop with
NotificatieTests.cs (accept/reject/missing-header, asserting the AuthzAuditStore
row), missing appsettings.json keys (also backfills DrcBaseUrl/
InformatieobjecttypeUrls, stale since WP-51), and the webhook + abonnement
provisioning docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/TestWebApplicationFactory.cs

@@ -27,8 +27,11 @@ public sealed class TestWebApplicationFactory : WebApplicationFactory<Program>
 {
   private readonly string _dbPath = Path.Combine(Path.GetTempPath(), $"bigregister-test-{Guid.NewGuid():N}.db");
 
-  protected override void ConfigureWebHost(IWebHostBuilder builder) =>
-      builder.UseSetting("ConnectionStrings:AppDb", $"Data Source={_dbPath}");
+  protected override void ConfigureWebHost(IWebHostBuilder builder) => builder
+      .UseSetting("ConnectionStrings:AppDb", $"Data Source={_dbPath}")
+      // WP-52: a fixed shared secret so NotificatieTests can exercise the accept path —
+      // the appsettings.json default is "" (reject everything), which no test should rely on.
+      .UseSetting("Zgw:NotificatieAuthorization", "test-nrc-secret");
 
   protected override void Dispose(bool disposing)
   {