feat(projection): persist the read projection and expose webhook + read APIs (refs #7)

Add the projection persistence and the two services around it:

- Projection.ReadModel: a shared EF Core (Npgsql) read model owning the projection
  schema — register_projection + the subscriber's processed_notifications log — plus
  EfProjectionStore / EfNotificationLog (atomic record-or-skip on the PK for idempotency)
  and the initial migration. One rebuildable store, written by the subscriber and read
  by projection-api (ADR-0008).
- EventSubscriber.Api: POST /notifications NRC callback (enforces the abonnement bearer,
  401 without it per ADR-0007), POST /admin/rebuild, /health. Migrates on start.
- ProjectionApi.Api: GET /register, GET /register/{id}, /health — the read side.

dotnet-ef pinned as a local tool for migrations; NuGetAuditMode=direct so EF's
design-time-only tooling transitive doesn't flag the shipped build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/projection-api/Projection.ReadModel/EfNotificationLog.cs

@@ -0,0 +1,39 @@
+using EventSubscriber.Application;
+using Microsoft.EntityFrameworkCore;
+
+namespace Projection.ReadModel;
+
+/// <summary>EF Core implementation of the notification log. Idempotency is enforced atomically
+/// by the primary key on <c>key</c>: a duplicate insert raises a unique violation, which is
+/// caught and reported as "already recorded" rather than failing the request.</summary>
+public sealed class EfNotificationLog(ProjectionDbContext db) : INotificationLog
+{
+    public async Task<bool> TryRecordAsync(RecordedNotification notification, CancellationToken ct = default)
+    {
+        db.ProcessedNotifications.Add(new ProcessedNotificationRow
+        {
+            Key = notification.Key,
+            Actie = notification.Actie,
+            ZaakId = notification.ZaakId,
+            ReceivedAt = DateTimeOffset.UtcNow,
+        });
+
+        try
+        {
+            await db.SaveChangesAsync(ct);
+            return true;
+        }
+        catch (DbUpdateException)
+        {
+            // Already recorded by an earlier (or concurrent) delivery — drop this duplicate.
+            db.ChangeTracker.Clear();
+            return false;
+        }
+    }
+
+    public async Task<IReadOnlyList<RecordedNotification>> AllAsync(CancellationToken ct = default)
+        => await db.ProcessedNotifications
+            .OrderBy(r => r.ReceivedAt)
+            .Select(r => new RecordedNotification(r.Key, r.Actie, r.ZaakId))
+            .ToListAsync(ct);
+}