feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Application/RegisterEntry.cs

@@ -9,6 +9,7 @@ namespace EventSubscriber.Application;
 public sealed record RegisterEntry(
     string Id,
     string Status,
+    string? Reference = null,
     string? Bsn = null,
     string? NaamPlaceholder = null);