test(acl): ObjectenGateway integration test against live Objecten (refs #149)

Drives the real gateway against a running Objecten + Objecttypen pair: two
writes for the same id leave exactly one object carrying the second write's
status, and nothing outside the public-safe schema. Runs under verify-acl,
inside the compose network — which it must, because Objecttypen echoes the
request Host into the objecttype `url` and Objecten only accepts the one
matching its configured api_root. ADR-0028 records that constraint.

docs/architecture/adr-0028-objecten-holds-the-register.md

@@ -93,6 +93,19 @@ declared up front, both stay idempotent, and neither has to wait for the other.
 The cost is a constant duplicated across two files that must be kept in step; each carries
 a comment pointing at the other.
 
+### The ACL must reach Objecttypen at the URL Objecten knows it by
+
+Objecttypen builds the `url` it returns from the request's own Host header, and Objecten
+matches an incoming object's `type` against the `api_root` it was configured with. So an
+ACL that reads Objecttypen at `http://localhost:8020` gets back a `localhost` objecttype
+URL that Objecten then rejects as "not one of the available choices" — even though it is
+the same objecttype.
+
+`Acl__Objecten__ObjecttypenBaseUrl` must therefore match Objecten's configured
+`api_root` (`http://objecttypen:8000/api/v2/`). This is the same class of constraint as
+ADR-0006's "point the ACL at OpenZaak's container IP", and it is why the Objecten
+integration tests only pass from inside the compose network.
+
 ### Objecten's notifications are off for this slice
 
 Objecten publishes to a Notificaties API on every write, and `notifications_api_common`
@@ -145,7 +158,11 @@ asserts, via `infra/register-record-check.py`, that Objecten holds exactly one
 `RegisterRecord` for that registration, with status `INGESCHREVEN` and no field outside
 the public-safe schema.
 
-Every HTTP exchange the gateway performs was additionally replayed by hand against a live
-Objecten + Objecttypen pair while writing this slice — objecttype lookup by name, version
-status, `data_attrs` search, create, update, and a rejected write carrying a `bsn`. Both
-findings above came out of that replay rather than out of CI.
+`ObjectenGatewayIntegrationTests` (`Category=Integration`, so it runs under `verify-acl`
+inside the compose network) drives the real gateway against a live Objecten + Objecttypen
+pair: two writes for the same id leave exactly one object, carrying the second write's
+status and nothing outside the public-safe schema.
+
+All three findings above — the pinned UUID, the notifications block, and the base-URL
+constraint — came out of running the gateway against those live modules while writing the
+slice, not out of CI.