docs: S-18b demo note + backlog — Objecten API up, wired to Objecttypen (refs #140)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -283,8 +283,8 @@ Split into independently deployable sub-slices (CLAUDE.md §13):
 
 Split into independently deployable sub-slices (CLAUDE.md §13):
 
-- **S-18a** (#139) · Objecttypen API up in compose (own DB + seeded config + health + static token).
-- **S-18b** (#140) · Objecten API up in compose, wired to Objecttypen. Depends on S-18a.
+- **S-18a** (#139, ✅) · Objecttypen API up in compose (own DB + seeded config + health + static token).
+- **S-18b** (#140, ✅) · Objecten API up in compose, wired to Objecttypen. Depends on S-18a.
 - **S-18c** (#141) · RegisterRecord objecttype defined + registered (public-safe JSON schema). Depends on S-18a/b.
 
 ### S-19 · ACL extension: write register-record to Objecten on approval

docs/demo-script.md

@@ -5,6 +5,38 @@ copy-pasteable walkthrough against a local `make up` stack.
 
 ---
 
+## S-18b — Objecten API up in compose, wired to Objecttypen (#140)
+
+**Outcome:** the upstream Maykin **Objecten API** runs in the stack — own **PostGIS** DB + redis,
+config seeded like the other CG modules (`objecten-init` runs `setup_configuration` from the
+`rr-objecten-config` volume: migrate + provision a dev **static API token** + register the
+**Objecttypen API** (S-18a) as a trusted service), a health-checked `objecten` web on host `:8021`.
+An object can now reference its objecttype; the ACL writes register records here on approval (S-19).
+
+```bash
+make up
+# 1. The API is up; the seeded token authenticates (401 without, 200 with):
+curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8021/api/v2/objects                                       # 401
+curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: Token 1234567890abcdef1234567890abcdef12345678" \
+  http://localhost:8021/api/v2/objects                                                                              # 200
+#
+# 2. It trusts Objecttypen — the seeded zgw_consumers service points at the Objecttypen API:
+docker exec infra-objecten-1 python src/manage.py shell -c \
+  "from zgw_consumers.models import Service; print(*[(s.slug,s.api_root) for s in Service.objects.all()])"
+#   → ('objecttypen', 'http://objecttypen:8000/api/v2/')
+#
+# 3. Automated (a CI verify-stack step): asserts unauth 401 + token 200, against the running stack.
+make verify-objecten           # → OK — no-auth 401, token 200
+```
+
+**The path:** verbatim upstream image (`maykinmedia/objects-api`, pinned 3.4.0) + the same seed
+pattern as S-18a — `infra/seed-config.sh objecten` streams `data.yaml` into an external config
+volume, `objecten-init` (RUN_SETUP_CONFIG) applies it. Its `zgw_consumers` step registers Objecttypen
+(`api_type: orc`, api-key auth with the S-18a dev token). The RegisterRecord objecttype (S-18c) and
+the ACL write path (S-19) build on this.
+
+---
+
 ## S-18a — Objecttypen API up in compose (#139)
 
 **Outcome:** the upstream Maykin **Objecttypen API** runs in the stack — own Postgres + redis, config