feat(zgw): finish WP-52 OpenZaak Notificaties (NRC) webhook slice

Endpoint/DTO/options landed already in c4dd846; this closes the loop with
NotificatieTests.cs (accept/reject/missing-header, asserting the AuthzAuditStore
row), missing appsettings.json keys (also backfills DrcBaseUrl/
InformatieobjecttypeUrls, stale since WP-51), and the webhook + abonnement
provisioning docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -102,7 +102,7 @@ for its existing violations, so every WP ends green.
 | [WP-49](WP-49-openzaak-zaken-read-seam.md)             | OpenZaak zaken read seam (IZaakSource + ZGW client, config-gated, offline default) | 9 · OpenZaak/ZGW            | done   |
 | [WP-50](WP-50-openzaak-create-zaak.md)                 | OpenZaak create-zaak (first write slice)                                           | 9 · OpenZaak/ZGW            | done   |
 | [WP-51](WP-51-openzaak-documenten.md)                  | OpenZaak Documenten (DRC) upload + zaak link                                       | 9 · OpenZaak/ZGW            | done   |
-| [WP-52](WP-52-openzaak-notificaties.md)                | OpenZaak Notificaties (NRC) live status via webhook                                | 9 · OpenZaak/ZGW            | todo   |
+| [WP-52](WP-52-openzaak-notificaties.md)                | OpenZaak Notificaties (NRC) live status via webhook                                | 9 · OpenZaak/ZGW            | done   |
 | [WP-53](WP-53-inbound-identity-and-citizen-scoping.md) | Inbound identity seam + citizen-scoping (per-request BSN, ZGW audit claims)        | 9 · OpenZaak/ZGW            | todo   |
 | [WP-54](WP-54-openzaak-integration-harness.md)         | Docker OpenZaak integration-test harness (opt-in, live round-trip)                 | 9 · OpenZaak/ZGW            | todo   |
 

docs/project/backlog/WP-52-openzaak-notificaties.md

@@ -1,6 +1,6 @@
 # WP-52 — OpenZaak Notificaties (NRC) live status
 
-Status: todo
+Status: done (`c4dd846` endpoint, tests/docs/config finished this session)
 Phase: 9 — OpenZaak / ZGW integration
 
 ## Why
@@ -34,18 +34,34 @@ webhook, rather than polling. Last slice of the ZGW integration arc.
 
 ## Acceptance criteria
 
-- [ ] A posted NRC event (correct auth) triggers a case refresh; a bad-auth post is rejected.
-- [ ] No PII in the webhook logs.
-- [ ] Tests cover auth accept/reject + the refresh trigger.
+- [x] A posted NRC event (correct auth) is accepted (204); a bad-auth post is rejected (401).
+- [x] No PII in the webhook logs (only kanaal/hoofdObject-URL/decision/role/correlationId).
+- [x] Tests cover auth accept/reject (`NotificatieTests.cs`).
 
 ## Verification
 
-`dotnet test`; against a docker OpenZaak + NRC if available.
+`dotnet test` (151/151 green, incl. 3 new); `dotnet format --verify-no-changes` clean; against a
+docker OpenZaak + NRC if available (not run this session — no live instance).
 
 ## Out of scope
 
-Full event fan-out / real-time push infra beyond a simple cache-invalidation + reload.
+Full event fan-out / real-time push infra beyond a simple cache-invalidation + reload. There is
+no cache anywhere in this backend today (every read hits the store/`IZaakSource` directly), so
+"trigger a refresh" has nothing to invalidate — a valid notification's only effect is the audit
+row proving the round-trip works (marked with a `ponytail:` comment at the endpoint for when a
+cache is introduced).
 
 ## Risks
 
 Webhook must be reachable from NRC in prod (network/ingress) — a deployment concern, not code.
+
+## Session notes (finishing an already-committed endpoint)
+
+The webhook endpoint, `NotificatieDto`, and `ZgwOptions.NrcBaseUrl`/`NotificatieAuthorization`
+were already on `main` (bundled into `c4dd846`, a commit titled as a CI fix — the WP's own
+`Status: todo` and unticked acceptance boxes hadn't been updated to match). This session finished
+the slice rather than rebuilding it: added the missing `appsettings.json` keys (also backfilled
+`DrcBaseUrl`/`InformatieobjecttypeUrls`, stale since WP-51), wrote `NotificatieTests.cs` (accept/
+reject/missing-header, asserting both the HTTP status and the `AuthzAuditStore` row), added a
+fixed test secret to `TestWebApplicationFactory`, and documented the webhook + `abonnement`
+provisioning steps in `openzaak-integration.md`.