fix(ci): unbreak backend format, storybook-a11y, and e2e jobs

- backend: dotnet format the WP-51 migration (2-space indent, no BOM)
  to match .editorconfig — dotnet format --verify-no-changes was failing.
- storybook: stub FeatureFlagStore (WP-47) in shell/site-header stories
  alongside AccessStore, fixing NG0201 no-provider errors; bump the
  storybook-a11y container's memory cap 4g→6g (build-storybook +
  compodoc measured ~5.8GB peak RSS, leaving too little headroom).
- backend: fix a startup-breaking bug in the new (WP-52) POST
  /zgw/notificaties handler — it took ZgwOptions as a minimal-API
  parameter, which isn't registered in DI, so ASP.NET's endpoint-table
  build threw on every request once the route was registered (incl.
  /swagger, which is why Playwright's webServer health check timed
  out). Close over the existing `zgw` local instead.
- e2e: brief-v2.spec.ts's "Voorbeeld" button locator was ambiguous
  once a second "Voorbeeld met testwaarden" button existed (Playwright
  name matching is substring-based) — added `exact: true`. Also fixed
  the sent-letter preview flow to match app-letter-composer's actual
  behavior (single click → fetch, no in-page dialog, unlike
  app-behandel-scherm's), and fixed a watermark assertion that checked
  for the always-present `.preview-watermark` CSS class name instead
  of the conditionally-rendered "VOORBEELD" marker text.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -1,3 +1,5 @@
+using System.Security.Cryptography;
+using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 using BigRegister.Api.Contracts;
@@ -353,6 +355,36 @@ api.MapGet("/admin/cases", (HttpContext ctx, IZaakSource zaken) => CasesAdmin(ct
 .Produces<List<ApplicationSummaryDto>>()
 .ProducesProblem(StatusCodes.Status403Forbidden);
 
+// OpenZaak's Notificaties API (NRC) calls this on every zaak event once an `abonnement` is
+// provisioned (WP-52, out-of-band — see openzaak-integration.md, no app code subscribes it).
+// The caller is NRC, not a user: no Principal, so this audits via AuthzAuditStore directly
+// rather than the Principal-shaped AuditAuthz helper below. A plain shared secret (not a
+// JWT — that's only for this BFF's OUTBOUND ZGW calls) compared in fixed time; an unconfigured
+// secret always rejects.
+api.MapPost("/zgw/notificaties", (HttpContext ctx, NotificatieDto body) =>
+{
+  var expected = zgw.NotificatieAuthorization;
+  var actual = ctx.Request.Headers.Authorization.ToString();
+  var allowed = !string.IsNullOrEmpty(expected)
+      && CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(actual), Encoding.UTF8.GetBytes(expected));
+
+  var cid = ctx.Items.TryGetValue("CorrelationId", out var v) ? (string)v! : "none";
+  app.Logger.LogInformation(
+      "authz action={Action} resource={Resource} decision={Decision} role={Role} correlationId={Cid}",
+      "zgw:notificatie", body.HoofdObject, allowed ? "allow" : "deny", "nrc", cid);
+  AuthzAuditStore.Record("zgw:notificatie", body.HoofdObject, allowed, "nrc", cid);
+
+  if (!allowed) return Results.Unauthorized();
+  // ponytail: nothing to invalidate — /admin/cases above already reads IZaakSource fresh
+  // every call, no cache exists anywhere in this backend. Add real invalidation here if/when
+  // one is introduced; today a valid notification's only effect is the audit trail proving
+  // the webhook round-trip works.
+  return Results.NoContent();
+})
+// NRC calls this directly, not the FE — same "hand-written, no client codegen" seam as
+// /uploads and /brief/reveal-bignummer.
+.ExcludeFromDescription();
+
 // Admin delete removes ANY case (any owner, submitted or not) — unlike the user-facing
 // DELETE /applications/{id}. A missing id is a 404.
 api.MapDelete("/admin/cases/{id}", (string id, HttpContext ctx) => CasesAdmin(ctx, () =>