feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78)

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/acceptance/Steps/RegisterProjectieBijwerkenSteps.cs

@@ -17,7 +17,8 @@ public sealed class RegisterProjectieBijwerkenSteps
     private readonly NotificationProjector _projector;
     private Notification? _notification;
 
-    public RegisterProjectieBijwerkenSteps() => _projector = new NotificationProjector(_log, _store);
+    public RegisterProjectieBijwerkenSteps()
+        => _projector = new NotificationProjector(_log, _store, new InMemoryAclReferenceClient());
 
     [Given("a zaak is created in OpenZaak with id \"(.*)\"")]
     public void GivenAZaakIsCreatedInOpenZaakWithId(string id)

tests/acceptance/Support/InMemoryProjectionStores.cs

@@ -38,3 +38,11 @@ public sealed class InMemoryProjectionStore : IProjectionStore
     public IReadOnlyList<RegisterEntry> RowsFor(string id)
         => [.. _byId.Values.Where(e => e.Id == id)];
 }
+
+/// <summary>A fake ACL client for the projection acceptance scenario: returns a reference derived
+/// from the zaak, so the projector can enrich rows without a running ACL (#78).</summary>
+public sealed class InMemoryAclReferenceClient : IAclClient
+{
+    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+        => Task.FromResult("REG-" + zaakUrl.Segments[^1].Trim('/'));
+}