feat(infra): Objecten publishes register events to NRC (refs #152)

Builds the four pieces ADR-0028 deliberately left absent, and turns
`NOTIFICATIONS_DISABLED` back off:

- `objecten-celery`, a worker on the Objecten image (mirrors `oz-celery`), plus
  `CELERY_BROKER_URL`/`RESULT_BACKEND` on objecten-redis db 1 (db 0 is the cache).
  Without it `notifications_api_common` queues the send and nothing ever ships it.
- An `nrc` service + `notifications_config` in Objecten's setup_configuration,
  reusing the `big-reference-seed` credential OpenZaak publishes with.
- The `objecten` kanaal in NRC's setup_configuration — the name is fixed by the
  Objects API (`NOTIFICATIONS_KANAAL`), and publishing to an unregistered kanaal is
  what the failing check reported first.
- `SITE_DOMAIN: objecten.local:8000` + an `objecten.local` network alias: NRC
  validates `hoofdObject`/`resourceUrl` with Django's URLValidator, which rejects a
  single-label host, so `objecten:8000` is refused with "Voer een geldige URL in."
  The alias keeps the dotted host resolvable so the URL still dereferences.

ADR-0029 records it; ADR-0028's ceiling now points there.

Makes `make verify-objecten-notifications` (dc9ca2c) pass.

infra/docker-compose.local.yml

@@ -691,12 +691,21 @@ services:
       CACHE_AXES: objecten-redis:6379/0
       DISABLE_2FA: "true"
       OTEL_SDK_DISABLED: "true"
-      # S-19a: Objecten refuses every write while its Notificaties config is absent
-      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
-      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
-      # notifications off rather than fake a delivery path that silently drops every message.
-      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
-      NOTIFICATIONS_DISABLED: "true"
+      # NRC validates hoofdObject/resourceUrl with Django's URLValidator, which rejects a
+      # single-label host — so notifications built from `objecten:8000` are refused with
+      # "Voer een geldige URL in." SITE_DOMAIN fixes the host Objecten puts in its notifications
+      # (objects.utils.get_domain), and the `objecten.local` network alias below keeps that host
+      # resolvable in-network so a subscriber can actually fetch the record it points at (S-19b-2).
+      SITE_DOMAIN: objecten.local:8000
+      IS_HTTPS: "no"
+      CELERY_BROKER_URL: redis://objecten-redis:6379/1
+      CELERY_RESULT_BACKEND: redis://objecten-redis:6379/1
+      # Publish register-record events to NRC on the `objecten` kanaal (S-19b-1, ADR-0029). The NRC
+      # service + notifications_config are provisioned by setup_configuration
+      # (infra/objecten/setup_configuration/data.yaml), and objecten-celery below actually sends
+      # them — notifications_api_common only queues the task. See ADR-0028 for why S-19a left this
+      # off until all four pieces existed.
+      NOTIFICATIONS_DISABLED: "false"
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
@@ -721,6 +730,22 @@ services:
       start_period: 30s
     ports:
       - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks:
+      cg:
+        aliases:
+          - objecten.local
+
+  # The celery worker that actually delivers Objecten's notifications to NRC (S-19b-1, ADR-0029).
+  # notifications_api_common only schedules the send on transaction commit; without a worker the
+  # task sits in redis forever and every register write is silently undelivered. Mirrors oz-celery.
+  # No beat: Objecten is a publisher, not a subscriber — nrc-beat drains the delivery queue.
+  objecten-celery:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env-local
+    command: /celery_worker.sh
     depends_on:
       objecten-init:
         condition: service_completed_successfully

infra/docker-compose.yml

@@ -717,12 +717,21 @@ services:
       CACHE_AXES: objecten-redis:6379/0
       DISABLE_2FA: "true"
       OTEL_SDK_DISABLED: "true"
-      # S-19a: Objecten refuses every write while its Notificaties config is absent
-      # (notifications_api_common raises rather than skipping, so POST /objects 500s). Objecten →
-      # NRC is not wired yet — there is no broker, worker, kanaal or abonnement for it — so turn
-      # notifications off rather than fake a delivery path that silently drops every message.
-      # S-19b (#150) sources the projection from Objecten and turns this back on for real.
-      NOTIFICATIONS_DISABLED: "true"
+      # NRC validates hoofdObject/resourceUrl with Django's URLValidator, which rejects a
+      # single-label host — so notifications built from `objecten:8000` are refused with
+      # "Voer een geldige URL in." SITE_DOMAIN fixes the host Objecten puts in its notifications
+      # (objects.utils.get_domain), and the `objecten.local` network alias below keeps that host
+      # resolvable in-network so a subscriber can actually fetch the record it points at (S-19b-2).
+      SITE_DOMAIN: objecten.local:8000
+      IS_HTTPS: "no"
+      CELERY_BROKER_URL: redis://objecten-redis:6379/1
+      CELERY_RESULT_BACKEND: redis://objecten-redis:6379/1
+      # Publish register-record events to NRC on the `objecten` kanaal (S-19b-1, ADR-0029). The NRC
+      # service + notifications_config are provisioned by setup_configuration
+      # (infra/objecten/setup_configuration/data.yaml), and objecten-celery below actually sends
+      # them — notifications_api_common only queues the task. See ADR-0028 for why S-19a left this
+      # off until all four pieces existed.
+      NOTIFICATIONS_DISABLED: "false"
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     # data.yaml is streamed into this external volume by infra/seed-config.sh before start.
@@ -750,6 +759,22 @@ services:
       start_period: 30s
     ports:
       - "8021:8000"
+    depends_on:
+      objecten-init:
+        condition: service_completed_successfully
+    networks:
+      cg:
+        aliases:
+          - objecten.local
+
+  # The celery worker that actually delivers Objecten's notifications to NRC (S-19b-1, ADR-0029).
+  # notifications_api_common only schedules the send on transaction commit; without a worker the
+  # task sits in redis forever and every register write is silently undelivered. Mirrors oz-celery.
+  # No beat: Objecten is a publisher, not a subscriber — nrc-beat drains the delivery queue.
+  objecten-celery:
+    image: docker.io/maykinmedia/objects-api:${OBJECTS_TAG:-3.4.0}
+    environment: *objecten-env
+    command: /celery_worker.sh
     depends_on:
       objecten-init:
         condition: service_completed_successfully

infra/objecten/setup_configuration/data.yaml

@@ -18,6 +18,16 @@ zgw_consumers:
       auth_type: api_key
       header_key: Authorization
       header_value: Token 0123456789abcdef0123456789abcdef01234567
+    # (1b) The NRC Objecten publishes register-record events to (S-19b-1, ADR-0029). Same shape and
+    # same big-reference-seed credential OpenZaak publishes with — NRC verifies the JWT and
+    # authorizes it via OpenZaak's AC, which grants that client heeft_alle_autorisaties.
+    - identifier: nrc
+      label: Open Notificaties
+      api_type: nrc
+      api_root: http://nrc-web:8000/api/v1/
+      auth_type: zgw
+      client_id: big-reference-seed
+      secret: insecure-dev-secret-change-me
 
 # (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
 # objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
@@ -40,3 +50,10 @@ tokenauth:
       email: admin@localhost
       organization: Respellion
       is_superuser: true
+
+# (4) Point Objecten's notifications at that NRC service (S-19b-1, ADR-0029). Requires
+# NOTIFICATIONS_DISABLED=false plus a celery broker + worker — without the worker the message is
+# queued and never sent, which is exactly the half-wired state S-19a refused to ship (ADR-0028).
+notifications_config_enable: true
+notifications_config:
+  notifications_api_service_identifier: nrc

infra/opennotificaties/setup_configuration/data.yaml

@@ -29,7 +29,9 @@ autorisaties_api_config_enable: true
 autorisaties_api:
   authorizations_api_service_identifier: openzaak-ac
 
-# 4. The kanaal OpenZaak publishes zaak events on.
+# 4. The kanalen publishers announce on: `zaken` (OpenZaak) and `objecten` (Objecten, S-19b-1).
+# Both authenticate with the big-reference-seed credential above, which OpenZaak's AC grants
+# heeft_alle_autorisaties — so no separate publisher authorization is needed for Objecten.
 notifications_kanalen_config_enable: true
 notifications_kanalen_config:
   items:
@@ -39,3 +41,11 @@ notifications_kanalen_config:
         - bronorganisatie
         - zaaktype
         - vertrouwelijkheidaanduiding
+    # 5. The kanaal Objecten publishes register-record events on (S-19b-1, ADR-0029). Its name is
+    # fixed by the Objects API itself (NOTIFICATIONS_KANAAL = "objecten"), not chosen here. The
+    # filter set matches what the Objects API sends as kenmerken, so an abonnement can narrow by
+    # objecttype rather than receiving every object write in the register.
+    - naam: objecten
+      documentatie_link: https://objects-and-objecttypes-api.readthedocs.io/
+      filters:
+        - object_type