feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

services/acl/Acl.IntegrationTests/OpenZaakGatewayIntegrationTests.cs

@@ -22,12 +22,14 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             "seed it with OZ_PUBLISH=1 (`make integration` does this).");
 
         var gateway = new OpenZaakGateway(stack.Http, stack.Options);
+        var reference = Guid.NewGuid().ToString(); // zaak identificatie must be unique per bronorganisatie
         var request = new ZaakRequest(
             Bronorganisatie: "517439943",
             VerantwoordelijkeOrganisatie: "517439943",
             Vertrouwelijkheidaanduiding: "openbaar",
             Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow));
+            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
+            Identificatie: reference);
 
         var zaakUrl = await gateway.OpenZaakAsync(request);
 
@@ -36,11 +38,12 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             new Uri(stack.BaseUrl, "/zaken/api/v1/zaken/").ToString(),
             zaakUrl.ToString());
 
-        // ...and that zaak is really persisted with the default-filled fields.
+        // ...and that zaak is really persisted with the default-filled fields + the reference identificatie.
         var zaak = await stack.GetZaakAsync(zaakUrl);
         Assert.Equal(zaaktype.ToString(), zaak.GetProperty("zaaktype").GetString());
         Assert.Equal("517439943", zaak.GetProperty("bronorganisatie").GetString());
         Assert.Equal("openbaar", zaak.GetProperty("vertrouwelijkheidaanduiding").GetString());
+        Assert.Equal(reference, zaak.GetProperty("identificatie").GetString());
     }
 
     [Fact]
@@ -57,7 +60,8 @@ public sealed class OpenZaakGatewayIntegrationTests(OpenZaakFixture stack)
             VerantwoordelijkeOrganisatie: "517439943",
             Vertrouwelijkheidaanduiding: "openbaar",
             Zaaktype: zaaktype!,
-            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow)));
+            Startdatum: DateOnly.FromDateTime(DateTime.UtcNow),
+            Identificatie: Guid.NewGuid().ToString()));
 
         await gateway.SetZaakToEindstatusAsync(zaakUrl, zaaktype!, DateOnly.FromDateTime(DateTime.UtcNow));