feat(infra): seed BIG catalogus + JWT client for OpenZaak (refs #2)

Provision a JWT client declaratively via OpenZaak setup_configuration
(infra/openzaak/setup_configuration/data.yaml: JWTSecret + Applicatie with
all authorizations), and seed the BIG catalogus + a lean BIG-REGISTRATIE
zaaktype (concept) + a bsn eigenschap via the ZTC API with an idempotent
stdlib seed (infra/openzaak/seed_catalogus.py, `make openzaak-seed`).

Disable outbound notifications until NRC lands (S-01-c) so ZTC writes don't
500. Bind-mount the config with :z (SELinux) for rootless Podman. Record
the design in ADR-0002; document seeding + the dev JWT client in the
OpenZaak runbook.

Verified clean-slate: down --volumes -> up -> `make openzaak-seed` creates
the catalogus/zaaktype/eigenschap and the JWT client lists BIG-REGISTRATIE;
re-runs are all-skip (idempotent).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -21,7 +21,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 
-.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-down help
+.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down help
 
 ## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
 ci: lint build unit smoke
@@ -71,6 +71,13 @@ openzaak-smoke:
 	  echo "GET /zaken/api/v1/      -> $$root (expect 200)"; test "$$root" = "200"; \
 	  echo "OpenZaak smoke OK"'
 
+## openzaak-seed: bring OpenZaak up and seed the BIG catalogus (idempotent)
+openzaak-seed: openzaak-up
+	@bash -c 'for i in $$(seq 1 50); do \
+	    c=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/catalogi/api/v1/ || true); \
+	    [ "$$c" = "200" ] && break; sleep 3; done; echo "OpenZaak ready ($$c)"'
+	python3 infra/openzaak/seed_catalogus.py
+
 ## openzaak-down: stop and remove the OpenZaak stack (wipes data)
 openzaak-down:
 	docker compose -f $(OZ_COMPOSE) down --volumes