feat(acl): resolve zaaktype + informatieobjecttype by business key, not a pinned URL (refs #113)

The ACL now discovers its BIG zaaktype (by identificatie) and diploma
informatieobjecttype (by omschrijving) from OpenZaak's Catalogi API, instead of
being handed server-assigned URLs in config. A CachedZaaktypeCatalog resolves
lazily on first use and caches (success only, so a pre-publish miss is retried);
AclDefaults now carries ZaaktypeIdentificatie/InformatieobjecttypeOmschrijving.
Clear errors replace the opaque placeholder-URL 400. Unit tests cover the
resolver (resolve/cache/retry-on-failure) and the gateway lookups (match/miss).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Infrastructure/OpenZaakGateway.cs

@@ -142,6 +142,48 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
         return created;
     }
 
+    public async Task<Uri> ResolveZaaktypeUrlAsync(string identificatie, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(identificatie);
+
+        // The published zaaktype with this identificatie; status=definitief excludes concepts.
+        var page = await GetAsync<ZaaktypePage>(
+            "/catalogi/api/v1/zaaktypen?status=definitief&identificatie=" + Uri.EscapeDataString(identificatie),
+            "zaaktypen", ct);
+        var match = (page.Results ?? []).FirstOrDefault()
+            ?? throw new InvalidOperationException(
+                $"No published zaaktype with identificatie '{identificatie}' found in OpenZaak — is the BIG catalogus seeded and published?");
+        return new Uri(match.Url);
+    }
+
+    public async Task<Uri> ResolveInformatieobjecttypeUrlAsync(string omschrijving, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(omschrijving);
+
+        // The informatieobjecttypen collection has no omschrijving filter, so match client-side over the
+        // published ones.
+        var page = await GetAsync<InformatieobjecttypePage>(
+            "/catalogi/api/v1/informatieobjecttypen?status=definitief", "informatieobjecttypen", ct);
+        var match = (page.Results ?? []).FirstOrDefault(i => i.Omschrijving == omschrijving)
+            ?? throw new InvalidOperationException(
+                $"No published informatieobjecttype '{omschrijving}' found in OpenZaak — is the BIG catalogus seeded and published?");
+        return new Uri(match.Url);
+    }
+
+    // GETs an absolute-by-path ZGW resource with auth (no CRS — catalogi is not a geo API).
+    private async Task<T> GetAsync<T>(string pathAndQuery, string label, CancellationToken ct)
+    {
+        using var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, pathAndQuery));
+        message.Headers.Authorization =
+            new AuthenticationHeaderValue("Bearer", ZgwToken.Mint(options.ClientId, options.Secret));
+
+        using var response = await http.SendAsync(message, ct);
+        await EnsureSuccessAsync(response, $"Querying {label}", ct);
+
+        return await response.Content.ReadFromJsonAsync<T>(ct)
+            ?? throw new InvalidOperationException($"OpenZaak returned an empty {label} response");
+    }
+
     // POSTs a non-geo ZGW resource (resultaat/status — no CRS headers). Buffers the body so uwsgi gets
     // a Content-Length instead of a chunked body (as with zaak-create).
     private async Task PostAsync(string path, object dto, string action, CancellationToken ct)
@@ -298,4 +340,18 @@ public sealed class OpenZaakGateway(HttpClient http, OpenZaakOptions options) :
     private sealed record ZaakInformatieobjectDto(
         [property: JsonPropertyName("zaak")] string Zaak,
         [property: JsonPropertyName("informatieobject")] string Informatieobject);
+
+    private sealed record ZaaktypePage(
+        [property: JsonPropertyName("results")] IReadOnlyList<ZaaktypeDto>? Results);
+
+    private sealed record ZaaktypeDto(
+        [property: JsonPropertyName("url")] string Url,
+        [property: JsonPropertyName("identificatie")] string? Identificatie);
+
+    private sealed record InformatieobjecttypePage(
+        [property: JsonPropertyName("results")] IReadOnlyList<InformatieobjecttypeDto>? Results);
+
+    private sealed record InformatieobjecttypeDto(
+        [property: JsonPropertyName("url")] string Url,
+        [property: JsonPropertyName("omschrijving")] string? Omschrijving);
 }