S-09b: Approval flow — temp admin endpoint + status transition to projection (#77)

## What & why

S-09b (#75, split from #10) — the **approval flow** that completes the walking skeleton. A behandelaar can now approve a submitted registration; the entry flips from `INGEDIEND` to `INGESCHREVEN` in the public register. Flow: `POST /registrations/{id}/approve` (domain) → ACL sets the zaak eindstatus (ZGW `/statussen`) → OpenZaak → NRC → event-subscriber → projection → openbaar.

## Changes (bottom-up, each red→green TDD)

- **Domain** — `RegistrationStatus.Ingeschreven` + `Registration.Approve()` (guards: opened zaak, only from INGEDIEND); `ApproveRegistration` use case (idempotent) + temp `POST /registrations/{id}/approve` endpoint; `IAclClient.ApproveZaakAsync`.
- **ACL** — resolves the zaaktype's **eindstatus** from the catalogus (`isEindstatus` / highest volgnummer) and POSTs a ZGW status; exposed as `POST /statussen`. Unit + real-OpenZaak integration test.
- **Event-subscriber** — binds NRC `hoofdObject`, projects a `status`/`create` as `INGESCHREVEN` keyed on the zaak (updates the existing row), **without reading OpenZaak** (§8.1). Retains the ZGW `resource` in the log (new column + EF migration) so a rebuild reproduces the status.
- **e2e** — extended: submit → public INGEDIEND → approve → public INGESCHREVEN.
- **Docs** — ADR-0011 (the two non-obvious decisions + the walking-skeleton assumption) + demo note.

## Key decisions (see ADR-0011)

- **ACL discovers the eindstatus** (chosen over injecting a statustype URL): no new config/seed plumbing, domain stays ZGW-ignorant.
- **Any post-creation status-set ⇒ INGESCHREVEN**: in the walking skeleton the only status ever set after creation is the approval, and the subscriber may not read ZGW — documented to tighten when more transitions arrive (S-12+).

## Verification

- All .NET unit suites green locally (domain 47, acl 11, event-subscriber 14, bff 16, acceptance 7); Release build + `dotnet format` clean.
- No new compose config (the eindstatus-discovery approach avoided it).
- The real-OpenZaak integration test (ACL status-set) and the full submit→approve→visible e2e run in CI `verify-stack` (live NRC→projection + selectielijst egress, not reproducible locally).

closes #75

Reviewed-on: #77

services/projection-api/Projection.ReadModel/EfNotificationLog.cs

@@ -15,6 +15,7 @@ public sealed class EfNotificationLog(ProjectionDbContext db) : INotificationLog
             Key = notification.Key,
             Actie = notification.Actie,
             ZaakId = notification.ZaakId,
+            Resource = notification.Resource,
             ReceivedAt = DateTimeOffset.UtcNow,
         });
 
@@ -34,6 +35,6 @@ public sealed class EfNotificationLog(ProjectionDbContext db) : INotificationLog
     public async Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default)
         => await db.ProcessedNotifications
             .OrderBy(r => r.ReceivedAt)
-            .Select(r => new RecordedNotification(r.Key, r.Actie, r.ZaakId))
+            .Select(r => new RecordedNotification(r.Key, r.Actie, r.ZaakId, r.Resource))
             .ToListAsync(ct);
 }

services/projection-api/Projection.ReadModel/Migrations/20260713145944_AddNotificationResource.Designer.cs

@@ -0,0 +1,84 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+using Projection.ReadModel;
+
+#nullable disable
+
+namespace Projection.ReadModel.Migrations
+{
+    [DbContext(typeof(ProjectionDbContext))]
+    [Migration("20260713145944_AddNotificationResource")]
+    partial class AddNotificationResource
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "10.0.0")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Projection.ReadModel.ProcessedNotificationRow", b =>
+                {
+                    b.Property<string>("Key")
+                        .HasColumnType("text")
+                        .HasColumnName("key");
+
+                    b.Property<string>("Actie")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("actie");
+
+                    b.Property<DateTimeOffset>("ReceivedAt")
+                        .HasColumnType("timestamp with time zone")
+                        .HasColumnName("received_at");
+
+                    b.Property<string>("Resource")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("resource");
+
+                    b.Property<string>("ZaakId")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("zaak_id");
+
+                    b.HasKey("Key");
+
+                    b.ToTable("processed_notifications", (string)null);
+                });
+
+            modelBuilder.Entity("Projection.ReadModel.RegisterEntryRow", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text")
+                        .HasColumnName("id");
+
+                    b.Property<string>("Bsn")
+                        .HasColumnType("text")
+                        .HasColumnName("bsn");
+
+                    b.Property<string>("NaamPlaceholder")
+                        .HasColumnType("text")
+                        .HasColumnName("naam_placeholder");
+
+                    b.Property<string>("Status")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("status");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("register_projection", (string)null);
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

services/projection-api/Projection.ReadModel/Migrations/20260713145944_AddNotificationResource.cs

@@ -0,0 +1,31 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Projection.ReadModel.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddNotificationResource : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Pre-existing rows are all zaak-creates (the only notification the projector recorded
+            // before S-09b), so default the backfill to "zaak" rather than "".
+            migrationBuilder.AddColumn<string>(
+                name: "resource",
+                table: "processed_notifications",
+                type: "text",
+                nullable: false,
+                defaultValue: "zaak");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "resource",
+                table: "processed_notifications");
+        }
+    }
+}

services/projection-api/Projection.ReadModel/Migrations/ProjectionDbContextModelSnapshot.cs

@@ -37,6 +37,11 @@ namespace Projection.ReadModel.Migrations
                         .HasColumnType("timestamp with time zone")
                         .HasColumnName("received_at");
 
+                    b.Property<string>("Resource")
+                        .IsRequired()
+                        .HasColumnType("text")
+                        .HasColumnName("resource");
+
                     b.Property<string>("ZaakId")
                         .IsRequired()
                         .HasColumnType("text")

services/projection-api/Projection.ReadModel/ProjectionDbContext.cs

@@ -35,6 +35,7 @@ public sealed class ProjectionDbContext(DbContextOptions<ProjectionDbContext> op
             e.Property(r => r.Key).HasColumnName("key");
             e.Property(r => r.Actie).HasColumnName("actie").IsRequired();
             e.Property(r => r.ZaakId).HasColumnName("zaak_id").IsRequired();
+            e.Property(r => r.Resource).HasColumnName("resource").IsRequired();
             e.Property(r => r.ReceivedAt).HasColumnName("received_at");
         });
     }
@@ -55,5 +56,10 @@ public sealed class ProcessedNotificationRow
     public required string Key { get; set; }
     public required string Actie { get; set; }
     public required string ZaakId { get; set; }
+
+    /// <summary>The ZGW resource (e.g. <c>zaak</c> or <c>status</c>) — retained so a rebuild reprojects
+    /// the right status without reading OpenZaak (S-09b).</summary>
+    public required string Resource { get; set; }
+
     public DateTimeOffset ReceivedAt { get; set; }
 }

services/projection-api/Projection.ReadModel/ServiceCollectionExtensions.cs

@@ -19,12 +19,46 @@ public static class ServiceCollectionExtensions
         return services;
     }
 
+    // A fixed application-scoped key for the migration advisory lock (any stable 64-bit constant).
+    private const long MigrationAdvisoryLockKey = 727501;
+
     /// <summary>Apply any pending EF migrations. Called once on service start so a fresh stack
-    /// reaches a usable schema without a manual migration step (DoD: compose up reaches green).</summary>
+    /// reaches a usable schema without a manual migration step (DoD: compose up reaches green).
+    ///
+    /// The Event Subscriber and the projection-api share this DB and both migrate on start. EF's
+    /// migrations-history lock is released between individual migrations, so with more than one pending
+    /// migration two migrators can interleave and one re-applies a migration the other just did
+    /// ("column already exists"). Hold a Postgres session <c>pg_advisory_lock</c> across the whole
+    /// sequence so it runs exactly once; the second migrator then finds nothing pending.</summary>
     public static async Task MigrateProjectionAsync(this IServiceProvider services, CancellationToken ct = default)
     {
         await using var scope = services.CreateAsyncScope();
         var db = scope.ServiceProvider.GetRequiredService<ProjectionDbContext>();
-        await db.Database.MigrateAsync(ct);
+        var connection = db.Database.GetDbConnection();
+
+        await connection.OpenAsync(ct);
+        try
+        {
+            await ExecuteAsync(connection, $"SELECT pg_advisory_lock({MigrationAdvisoryLockKey})", ct);
+            try
+            {
+                await db.Database.MigrateAsync(ct);
+            }
+            finally
+            {
+                await ExecuteAsync(connection, $"SELECT pg_advisory_unlock({MigrationAdvisoryLockKey})", ct);
+            }
+        }
+        finally
+        {
+            await connection.CloseAsync();
+        }
+    }
+
+    private static async Task ExecuteAsync(System.Data.Common.DbConnection connection, string sql, CancellationToken ct)
+    {
+        await using var command = connection.CreateCommand();
+        command.CommandText = sql;
+        await command.ExecuteNonQueryAsync(ct);
     }
 }

services/projection-api/ProjectionApi.Api/Program.cs

@@ -10,8 +10,9 @@ builder.Services.AddProjectionReadModel(connectionString);
 
 var app = builder.Build();
 
-// Ensure the schema exists before serving reads. EF serialises concurrent migrators via the
-// migrations-history lock, so it is safe that the Event Subscriber migrates too.
+// Ensure the schema exists before serving reads. The Event Subscriber migrates this shared DB too;
+// MigrateProjectionAsync serialises concurrent migrators with a session advisory lock so the whole
+// migration sequence runs exactly once (see ServiceCollectionExtensions).
 await app.Services.MigrateProjectionAsync();
 
 app.MapGet("/health", () => "Healthy");