refactor(infra): bake config via dockerfile_inline, drop Dockerfile files (refs #30)

Replaces the three standalone Dockerfiles (openzaak, opennotificaties,
keycloak) with `build.dockerfile_inline` recipes in the compose files, so the
config bake has no separate Dockerfile artifacts to maintain. Behaviour is
identical: each derived image still COPYies its config in.

- oz-init / keycloak / flowable-init: 2-line inline Dockerfiles.
- Open Notificaties needs no bake at all now — nrc-init runs migrations only,
  so all NRC services use the plain base image (removes a whole derived image).

Why dockerfile_inline and not `docker cp` into named volumes: docker cp avoids
images entirely but needs `docker compose create`, which podman-compose (the
local dev runtime) does not implement — it would break `make openzaak-up` etc.
locally. dockerfile_inline works on both podman-compose and the CI runner
(verified both: oz-init + keycloak inline builds locally; flowable-init inline
has been green on CI since run 27).

Docs updated: gitea-actions-gotchas.md and openzaak.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/openzaak/Dockerfile

@@ -1,12 +0,0 @@
-# Derived OpenZaak image with the setup_configuration YAML baked in.
-#
-# Why bake instead of bind-mount: Gitea's containerized `ubuntu-latest` runner
-# runs the job inside a container, so `docker compose` starts the stack as
-# SIBLING containers via the host daemon. A bind mount of a workspace path is
-# then resolved on the daemon host (where it does not exist), and Docker mounts
-# an empty directory — oz-init would not find data.yaml and exits 1. Baking the
-# file into the image makes it present regardless of runtime (local Podman or
-# CI Docker-in-Docker). See docs/runbooks/gitea-actions-gotchas.md.
-ARG OPENZAAK_TAG=1.28.2
-FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG}
-COPY setup_configuration /app/setup_configuration

infra/openzaak/docker-compose.yml

@@ -32,11 +32,13 @@ services:
     networks: [cg]
 
   oz-init:
+    # Derived image: base OpenZaak + setup_configuration baked in via an inline
+    # Dockerfile. See docs/runbooks/gitea-actions-gotchas.md for why not a mount.
     build:
       context: .
-      dockerfile: Dockerfile
-      args:
-        OPENZAAK_TAG: ${OPENZAAK_TAG:-1.28.2}
+      dockerfile_inline: |
+        FROM docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
+        COPY setup_configuration /app/setup_configuration
     image: register-referentie/openzaak:dev
     environment: &oz-env
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker