refactor(infra): bake config via dockerfile_inline, drop Dockerfile files (refs #30)

Replaces the three standalone Dockerfiles (openzaak, opennotificaties,
keycloak) with `build.dockerfile_inline` recipes in the compose files, so the
config bake has no separate Dockerfile artifacts to maintain. Behaviour is
identical: each derived image still COPYies its config in.

- oz-init / keycloak / flowable-init: 2-line inline Dockerfiles.
- Open Notificaties needs no bake at all now — nrc-init runs migrations only,
  so all NRC services use the plain base image (removes a whole derived image).

Why dockerfile_inline and not `docker cp` into named volumes: docker cp avoids
images entirely but needs `docker compose create`, which podman-compose (the
local dev runtime) does not implement — it would break `make openzaak-up` etc.
locally. dockerfile_inline works on both podman-compose and the CI runner
(verified both: oz-init + keycloak inline builds locally; flowable-init inline
has been green on CI since run 27).

Docs updated: gitea-actions-gotchas.md and openzaak.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/runbooks/openzaak.md

@@ -74,6 +74,6 @@ The Makefile auto-points `DOCKER_HOST` at the Podman socket when it exists, so t
 - **Image tag.** Pinned to `openzaak/open-zaak:1.28.2` via `${OPENZAAK_TAG}` (bump
   deliberately, not via `:latest`).
 - **Config is baked, not mounted.** `setup_configuration/data.yaml` is `COPY`-ed into
-  a derived image (`infra/openzaak/Dockerfile`) rather than bind-mounted, so the
-  init container finds it on Gitea's containerized CI runner too. See
-  [gitea-actions-gotchas.md](gitea-actions-gotchas.md).
+  a derived image via `oz-init`'s inline Dockerfile (`build.dockerfile_inline` in
+  the compose) rather than bind-mounted, so the init container finds it on Gitea's
+  containerized CI runner too. See [gitea-actions-gotchas.md](gitea-actions-gotchas.md).