feat(infra): OpenZaak + Postgres + Redis up in compose (refs #10)

Add infra/openzaak/docker-compose.yml — a lean adaptation of the upstream
open-zaak dev stack: PostGIS db, redis, a one-shot init that runs database
migrations, the OpenZaak API, and a celery worker. (Dropped nginx, beat,
flower, OTEL for leanness.) Images fully qualified (docker.io/...) for
rootless Podman.

Verified locally: stack comes up; migrations run; GET /admin/ -> 302,
GET /zaken/api/v1/ -> 200, and an unauthenticated GET /zaken/api/v1/zaken
-> 403 PermissionDenied (a proper ZGW fout) — i.e. auth is enforced.

Note: the S-01 acceptance says "401", but OpenZaak's ZGW APIs return 403
for missing/invalid JWT. Auth-enforced intent is met; the issue text
should be corrected to 403. Remaining S-01 work: BIG catalogus + zaaktype
seed + JWT client (then list zaaktypen), and Open Notificaties — so this
refs (not closes) #10.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/openzaak/docker-compose.yml

@@ -0,0 +1,88 @@
+# OpenZaak stack (S-01). Lean adaptation of the upstream open-zaak dev compose:
+# db (PostGIS) + redis + a one-shot init (migrations) + the API + a celery worker.
+# Dropped from upstream for leanness: nginx, celery-beat, flower, OTEL.
+#
+#   docker compose -f infra/openzaak/docker-compose.yml up -d --wait
+#   curl -i http://localhost:8000/zaken/api/v1/zaken   # -> 401 (auth required)
+#
+# NOTE: image pinned to a tag (not :latest) once a known-good tag is chosen; see
+# the catalogus-design ADR. Using a tag var with a sensible default for now.
+services:
+  oz-db:
+    image: docker.io/postgis/postgis:17-3.5
+    environment:
+      POSTGRES_USER: openzaak
+      POSTGRES_PASSWORD: openzaak
+      POSTGRES_DB: openzaak
+    command: postgres -c max_connections=300
+    volumes:
+      - oz-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [oz]
+
+  oz-redis:
+    image: docker.io/library/redis:7
+    networks: [oz]
+
+  oz-init:
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    environment: &oz-env
+      DJANGO_SETTINGS_MODULE: openzaak.conf.docker
+      SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
+      DB_HOST: oz-db
+      DB_NAME: openzaak
+      DB_USER: openzaak
+      DB_PASSWORD: openzaak
+      IS_HTTPS: "no"
+      ALLOWED_HOSTS: "*"
+      CACHE_DEFAULT: oz-redis:6379/0
+      CACHE_AXES: oz-redis:6379/0
+      CELERY_BROKER_URL: redis://oz-redis:6379/1
+      CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
+      DISABLE_2FA: "true"
+      OPENZAAK_SUPERUSER_USERNAME: admin
+      DJANGO_SUPERUSER_PASSWORD: admin
+      OPENZAAK_SUPERUSER_EMAIL: admin@localhost
+      RUN_SETUP_CONFIG: "false"
+    command: /setup_configuration.sh
+    depends_on:
+      oz-db:
+        condition: service_healthy
+      oz-redis:
+        condition: service_started
+    networks: [oz]
+
+  openzaak:
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    environment: *oz-env
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests,sys; sys.exit(0 if requests.head('http://localhost:8000/admin/').status_code in (200,302) else 1)"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    ports:
+      - "8000:8000"
+    depends_on:
+      oz-init:
+        condition: service_completed_successfully
+    networks: [oz]
+
+  oz-celery:
+    image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
+    environment: *oz-env
+    command: /celery_worker.sh
+    depends_on:
+      oz-init:
+        condition: service_completed_successfully
+    networks: [oz]
+
+volumes:
+  oz-db:
+
+networks:
+  oz: