refactor(infra): bake config via dockerfile_inline, drop Dockerfile files (refs #30)

Replaces the three standalone Dockerfiles (openzaak, opennotificaties,
keycloak) with `build.dockerfile_inline` recipes in the compose files, so the
config bake has no separate Dockerfile artifacts to maintain. Behaviour is
identical: each derived image still COPYies its config in.

- oz-init / keycloak / flowable-init: 2-line inline Dockerfiles.
- Open Notificaties needs no bake at all now — nrc-init runs migrations only,
  so all NRC services use the plain base image (removes a whole derived image).

Why dockerfile_inline and not `docker cp` into named volumes: docker cp avoids
images entirely but needs `docker compose create`, which podman-compose (the
local dev runtime) does not implement — it would break `make openzaak-up` etc.
locally. dockerfile_inline works on both podman-compose and the CI runner
(verified both: oz-init + keycloak inline builds locally; flowable-init inline
has been green on CI since run 27).

Docs updated: gitea-actions-gotchas.md and openzaak.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -47,11 +47,16 @@ services:
     networks: [cg]
 
   oz-init:
+    # Derived image: base OpenZaak + the setup_configuration YAML baked in. We use
+    # an inline Dockerfile (not a separate file, not a bind mount) because bind
+    # mounts don't reach sibling containers on the containerized CI runner.
+    # The ${OPENZAAK_TAG} below is interpolated by Compose. See
+    # docs/runbooks/gitea-actions-gotchas.md.
     build:
       context: ./openzaak
-      dockerfile: Dockerfile
-      args:
-        OPENZAAK_TAG: ${OPENZAAK_TAG:-1.28.2}
+      dockerfile_inline: |
+        FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
+        COPY setup_configuration /app/setup_configuration
     image: register-referentie/openzaak:dev
     environment: &oz-env
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
@@ -127,12 +132,9 @@ services:
     networks: [cg]
 
   nrc-init:
-    build:
-      context: ./opennotificaties
-      dockerfile: Dockerfile
-      args:
-        OPENNOTIFICATIES_TAG: ${OPENNOTIFICATIES_TAG:-1.16.1}
-    image: register-referentie/opennotificaties:dev
+    # Plain base image — nrc-init runs migrations only (see command below), so it
+    # needs no baked config.
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
@@ -165,7 +167,7 @@ services:
     networks: [cg]
 
   nrc-web:
-    image: register-referentie/opennotificaties:dev
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     healthcheck:
       test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
@@ -181,7 +183,7 @@ services:
     networks: [cg]
 
   nrc-celery:
-    image: register-referentie/opennotificaties:dev
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: *nrc-env
     command: /celery_worker.sh
     depends_on:
@@ -191,9 +193,13 @@ services:
 
   # ── Keycloak (S-02) ──────────────────────────────────────────────────────
   keycloak:
+    # Derived image: base Keycloak + the realm exports baked into the import dir
+    # (inline Dockerfile, no bind mount — see docs/runbooks/gitea-actions-gotchas.md).
     build:
       context: ./keycloak
-      dockerfile: Dockerfile
+      dockerfile_inline: |
+        FROM quay.io/keycloak/keycloak:26.1
+        COPY realms /opt/keycloak/data/import
     image: register-referentie/keycloak:dev
     command: ["start-dev", "--import-realm"]
     environment: