S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

services/event-subscriber/EventSubscriber.Tests/NotificationProjectorTests.cs

@@ -8,6 +8,7 @@ namespace EventSubscriber.Tests;
 public sealed class NotificationProjectorTests
 {
     private const string ZaakUrl = "http://openzaak:8000/zaken/api/v1/zaken/11111111-1111-1111-1111-111111111111";
+    private const string StatusUrl = "http://openzaak:8000/zaken/api/v1/statussen/22222222-2222-2222-2222-222222222222";
 
     private readonly InMemoryNotificationLog _log = new();
     private readonly InMemoryProjectionStore _store = new();
@@ -17,6 +18,10 @@ public sealed class NotificationProjectorTests
     private static Notification ZaakCreated(string url = ZaakUrl)
         => new("zaken", "zaak", "create", new Uri(url));
 
+    // A status-set notification: resourceUrl is the status resource, hoofdObject is the zaak it belongs to.
+    private static Notification StatusSet(string zaakUrl = ZaakUrl, string statusUrl = StatusUrl)
+        => new("zaken", "status", "create", new Uri(statusUrl), new Uri(zaakUrl));
+
     [Fact]
     public async Task creating_a_zaak_writes_one_row_with_status_ingediend()
     {
@@ -62,16 +67,53 @@ public sealed class NotificationProjectorTests
     [Theory]
     [InlineData("documenten", "enkelvoudiginformatieobject", "create")] // wrong kanaal + resource
     [InlineData("documenten", "zaak", "create")]                        // wrong kanaal only
-    [InlineData("zaken", "status", "create")]                           // wrong resource only
     [InlineData("zaken", "zaak", "update")]                             // wrong actie
     [InlineData("zaken", "zaak", "destroy")]                            // wrong actie
-    public async Task only_a_zaken_zaak_create_notification_is_projected(string kanaal, string resource, string actie)
+    [InlineData("zaken", "status", "update")]                           // a status change we ignore
+    [InlineData("zaken", "resultaat", "create")]                        // not a status we project
+    public async Task an_unrelated_notification_is_not_projected(string kanaal, string resource, string actie)
     {
         await Projector().HandleAsync(new Notification(kanaal, resource, actie, new Uri(ZaakUrl)));
 
         Assert.Empty(await _store.AllAsync());
     }
 
+    [Fact]
+    public async Task setting_a_status_projects_ingeschreven_keyed_on_the_zaak_not_the_status()
+    {
+        await Projector().HandleAsync(StatusSet());
+
+        var entry = Assert.Single(await _store.AllAsync());
+        // Keyed on the zaak (hoofdObject), not the status resource URL.
+        Assert.Equal("11111111-1111-1111-1111-111111111111", entry.Id);
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
+    [Fact]
+    public async Task approving_updates_the_existing_zaak_row_from_ingediend_to_ingeschreven()
+    {
+        var projector = Projector();
+        await projector.HandleAsync(ZaakCreated());
+        await projector.HandleAsync(StatusSet());
+
+        var entry = Assert.Single(await _store.AllAsync());
+        Assert.Equal("11111111-1111-1111-1111-111111111111", entry.Id);
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
+    [Fact]
+    public async Task rebuild_reproduces_the_approved_status()
+    {
+        var projector = Projector();
+        await projector.HandleAsync(ZaakCreated());
+        await projector.HandleAsync(StatusSet());
+
+        await projector.RebuildAsync();
+
+        var entry = Assert.Single(await _store.AllAsync());
+        Assert.Equal(RegistrationStatus.Ingeschreven, entry.Status);
+    }
+
     [Fact]
     public async Task rebuild_clears_stale_rows_and_repopulates_from_the_notification_log()
     {