feat(#78): one citizen reference across self-service and the openbaar register (#79)

## What & why

Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**:

- **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`.
- **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log.
- **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL.

Decision recorded in **ADR-0012**.

## Definition of Done

- [x] Linked issue: #78
- [x] Tests written first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
- [x] Frontend lint + test green (`nx run-many -t lint test`)
- [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
- [x] e2e extended: confirmation reference == register reference
- [x] openapi.json + api-client regenerated (drift guard green)
- [x] ADR-0012 added; demo-script note appended
- [x] `Acl__BaseUrl` wired for the subscriber in compose

closes #78

Reviewed-on: #79

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -26,11 +26,13 @@ public sealed class InMemoryAclClient : IAclClient
     public static readonly Uri OpenedZaakUrl = new("http://openzaak/zaken/api/v1/zaken/acc-zaak");
 
     public string? OpenedForBsn { get; private set; }
+    public string? OpenedWithReference { get; private set; }
     public Uri? ApprovedZaakUrl { get; private set; }
 
-    public Task<Uri> OpenZaakAsync(string bsn, CancellationToken ct = default)
+    public Task<Uri> OpenZaakAsync(string bsn, string reference, CancellationToken ct = default)
     {
         OpenedForBsn = bsn;
+        OpenedWithReference = reference;
         return Task.FromResult(OpenedZaakUrl);
     }
 

tests/acceptance/Support/InMemoryProjectionStores.cs

@@ -38,3 +38,11 @@ public sealed class InMemoryProjectionStore : IProjectionStore
     public IReadOnlyList<RegisterEntry> RowsFor(string id)
         => [.. _byId.Values.Where(e => e.Id == id)];
 }
+
+/// <summary>A fake ACL client for the projection acceptance scenario: returns a reference derived
+/// from the zaak, so the projector can enrich rows without a running ACL (#78).</summary>
+public sealed class InMemoryAclReferenceClient : IAclClient
+{
+    public Task<string> GetZaakReferenceAsync(Uri zaakUrl, CancellationToken ct = default)
+        => Task.FromResult("REG-" + zaakUrl.Segments[^1].Trim('/'));
+}

tests/acceptance/Support/InMemoryZaakGateway.cs

@@ -24,4 +24,7 @@ public sealed class InMemoryZaakGateway : IZaakGateway
         Approved = (zaakUrl, zaaktypeUrl, datumStatusGezet);
         return Task.CompletedTask;
     }
+
+    public Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default)
+        => Task.FromResult("ACC-REF-1");
 }