feat(event-subscriber): project a status-set as INGESCHREVEN via hoofdObject (refs #75)

Bind the NRC hoofdObject, recognise a zaken/status/create notification, and key the
projection on the zaak (hoofdObject) so the status updates the existing INGEDIEND row
to INGESCHREVEN — without reading OpenZaak (§8.1). Retain the ZGW resource in the log
(new column + migration) so a rebuild reproduces the approved status. Updates the
acceptance fakes for the new IAclClient/IZaakGateway members.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/projection-api/Projection.ReadModel/Migrations/20260713145944_AddNotificationResource.cs

@@ -0,0 +1,31 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Projection.ReadModel.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddNotificationResource : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            // Pre-existing rows are all zaak-creates (the only notification the projector recorded
+            // before S-09b), so default the backfill to "zaak" rather than "".
+            migrationBuilder.AddColumn<string>(
+                name: "resource",
+                table: "processed_notifications",
+                type: "text",
+                nullable: false,
+                defaultValue: "zaak");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "resource",
+                table: "processed_notifications");
+        }
+    }
+}