feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/event-subscriber/EventSubscriber.Tests/InMemoryStores.cs

@@ -5,6 +5,19 @@ namespace EventSubscriber.Tests;
 /// <summary>In-memory stand-ins for the projection store and notification log, so the
 /// projector's behaviour is exercised without Postgres (hand-written stubs, the repo's
 /// convention — no mocking library).</summary>
+/// <summary>A fake ACL client that returns a fixed reference derived from the zaak, and records
+/// how many times it was called (to prove a rebuild does not re-read via the ACL).</summary>
+internal sealed class FakeAclClient : IAclClient
+{
+    public int CallCount { get; private set; }
+
+    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+    {
+        CallCount++;
+        return Task.FromResult("REG-" + zaakUrl.Segments[^1].Trim('/'));
+    }
+}
+
 internal sealed class InMemoryNotificationLog : INotificationLog
 {
     private readonly Dictionary<string, RecordedNotification> _byKey = [];