S-18b · Objecten API up in compose, wired to Objecttypen (closes #140) (#143)

## What & why

S-18b, second of the S-18 (#19) split (after S-18a #139/#142). Stands up the upstream Maykin **Objecten API** in the compose stack and wires it to the Objecttypen API — the authoritative object store the ACL will write register records to (S-19).

Closes #140

### What

- **Compose** (main + local): `objecten-db` (**PostGIS** — objects carry geometry), `objecten-redis`, `objecten-init` (RUN_SETUP_CONFIG → migrate + provision token + register the Objecttypen service), `objecten` web (health on `/admin/`, host `:8021`). Verbatim upstream image `maykinmedia/objects-api` pinned to `3.4.0` (nearest release to objecttypes-api `3.4.2`; the two speak over the stable Objecttypes API v2).
- **Seed**: `infra/seed-config.sh objecten` streams `infra/objecten/setup_configuration/data.yaml` into the external `rr-objecten-config` volume — same pattern as S-18a. The data.yaml (1) registers **Objecttypen** as a trusted `zgw_consumers` service (`api_type: orc`, api-key auth with the S-18a dev token) so an object can reference its objecttype, and (2) provisions a dev **static API token** so peers (the ACL, S-19) can write objects.
- **Wiring**: added to `WAIT_SVCS`, `CFG_VOLS`, the `SEED` invocations, `seed-config.sh`, and the CI log-dump. `objecten-init` waits on `objecttypen` being healthy so the service registration is meaningful end to end.
- **Smoke**: `verify-objecten` (`infra/run-objecten-check.sh` + `objecten-check.py`) asserts unauth → 401, token → 200 on `/api/v2/objects`; added as a verify-stack step + a row in the #136 check-summary table.

## Verified locally (end to end, real compose)

Seeded + brought up the real `infra/docker-compose.yml` objecten chain (pulls in objecttypen via `depends_on`): `objecten-init` ran setup_configuration — `token_configuration_success` **and** "Successfully executed step: Configuration to connect with external services" — the web reached healthy, and `make verify-objecten` → **"OK — no-auth 401, token 200"**. Confirmed the registered service via the Objecten django shell:

```
objecttypen | orc | http://objecttypen:8000/api/v2/ | api_key
```

YAML (both compose files + ci.yaml) + shell + python all validated; `docker compose config` clean on both files.

## Definition of Done

- [x] Failing smoke committed first (`test(infra): …`, "no running objecten container"); implementation makes it pass.
- [x] Conventional Commits referencing #140.
- [ ] CI green (verify-stack objecten step).
- [x] `docker compose up` reaches health (objecten healthy on first poll locally).
- [x] Demo note in `docs/demo-script.md`.
- [x] Closed by the merging PR (`closes #140`).

No new ADR: follows the established verbatim-image + seed-config CG-module pattern (S-18a/ADR-0023-era).

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #143

docs/demo-script.md

@@ -5,6 +5,38 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-18b — Objecten API up in compose, wired to Objecttypen (#140)
+
+**Outcome:** the upstream Maykin **Objecten API** runs in the stack — own **PostGIS** DB + redis,
+config seeded like the other CG modules (`objecten-init` runs `setup_configuration` from the
+`rr-objecten-config` volume: migrate + provision a dev **static API token** + register the
+**Objecttypen API** (S-18a) as a trusted service), a health-checked `objecten` web on host `:8021`.
+An object can now reference its objecttype; the ACL writes register records here on approval (S-19).
+
+```bash
+make up
+# 1. The API is up; the seeded token authenticates (401 without, 200 with):
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8021/api/v2/objects                                       # 401
+curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 1234567890abcdef1234567890abcdef12345678" \
+  http://localhost:8021/api/v2/objects                                                                              # 200
+#
+# 2. It trusts Objecttypen — the seeded zgw_consumers service points at the Objecttypen API:
+docker exec infra-objecten-1 python src/manage.py shell -c \
+  "from zgw_consumers.models import Service; print(*[(s.slug,s.api_root) for s in Service.objects.all()])"
+#   → ('objecttypen', 'http://objecttypen:8000/api/v2/')
+#
+# 3. Automated (a CI verify-stack step): asserts unauth 401 + token 200, against the running stack.
+make verify-objecten           # → OK — no-auth 401, token 200
+```
+
+**The path:** verbatim upstream image (`maykinmedia/objects-api`, pinned 3.4.0) + the same seed
+pattern as S-18a — `infra/seed-config.sh objecten` streams `data.yaml` into an external config
+volume, `objecten-init` (RUN_SETUP_CONFIG) applies it. Its `zgw_consumers` step registers Objecttypen
+(`api_type: orc`, api-key auth with the S-18a dev token). The RegisterRecord objecttype (S-18c) and
+the ACL write path (S-19) build on this.
+
+---
+
 ## S-18a — Objecttypen API up in compose (#139)
 
 **Outcome:** the upstream Maykin **Objecttypen API** runs in the stack — own Postgres + redis, config