feat(acl): implement OpenZaak default-fill + ZGW gateway (refs #5)

AclService.OpenZaakAsync builds a ZaakRequest from the configured defaults
(bronorganisatie, verantwoordelijkeOrganisatie, vertrouwelijkheidaanduiding,
zaaktype) plus today's date from the clock, and delegates to the gateway.
OpenZaakGateway POSTs the zaak to /zaken/api/v1/zaken with a ZGW Bearer JWT
and the CRS headers, returning the created zaak URL. Tests pass (green).

Add a root register-referentie.slnx (bff + acl) and point `make ci` at it so
the gate covers every .NET service.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -5,7 +5,7 @@
 # `make ci` locally runs exactly what the pipeline runs — no drift. Until a
 # self-hosted runner is registered, `make ci` is the gate (see docs/runbooks/ci.md).
 
-SLN        := services/bff/Bff.slnx
+SLN        := register-referentie.slnx
 COMPOSE    := infra/docker-compose.yml
 HEALTH_URL := http://localhost:8080/health
 OZ_COMPOSE  := infra/openzaak/docker-compose.yml