feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Application/Ports.cs

@@ -20,9 +20,20 @@ public interface INotificationLog
 }
 
 /// <summary>A notification that has been accepted, retaining what a rebuild needs to recompute its
-/// projection row — including the ZGW <c>resource</c>, which distinguishes a zaak-create (INGEDIEND)
-/// from a status-set (INGESCHREVEN) so a rebuild reproduces the right status.</summary>
-public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource);
+/// projection row — the ZGW <c>resource</c> (zaak-create → INGEDIEND vs status-set → INGESCHREVEN) and
+/// the zaak <c>reference</c> (identificatie), so a rebuild reproduces the row without re-reading ZGW (#78).</summary>
+public sealed record RecordedNotification(string Key, string Actie, string ZaakId, string Resource, string? Reference);
+
+/// <summary>
+/// Port to the Anti-Corruption Layer. The subscriber enriches the projection with the zaak's
+/// public-safe reference (its identificatie) by asking the ACL — the only code that may read ZGW
+/// (§8.1) — rather than reading OpenZaak itself (adr-proposal #78).
+/// </summary>
+public interface IAclClient
+{
+    /// <summary>The zaak's reference (identificatie) for the read projection.</summary>
+    Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default);
+}
 
 /// <summary>The read projection store. Owned by the projection bounded context (ADR-0008); the
 /// subscriber writes to it and the projection-api reads it.</summary>