feat(acl): write the RegisterRecord to Objecten on approval (refs #149)

ApproveZaakAsync now does two writes: the ZGW eindstatus (the process) and the
register record in Objecten (the register). The record is keyed on the zaak
UUID — the same key the read projection rows carry — and its reference is the
zaak's identificatie, so nothing personal crosses into the world-readable
register (ADR-0027).

ObjectenGateway resolves the objecttype by name (its URL and version are
assigned at seed time, as with ADR-0021), searches for an existing object by
data attribute, then POSTs or PATCHes. Resolution is lazy, so the ACL needs no
depends_on on Objecten and does not crash-loop when it boots first.

infra/docker-compose.yml

@@ -323,6 +323,14 @@ services:
       # so verify-domain still points the ACL at OpenZaak's container IP.
       Acl__Defaults__ZaaktypeIdentificatie: BIG-REGISTRATIE
       Acl__Defaults__InformatieobjecttypeOmschrijving: Diploma
+      # Objecten holds the register, OpenZaak holds the process (S-19a, ADR-0028). Both APIs take a
+      # static token, not a ZGW JWT. The objecttype URL is assigned at seed time, so the ACL resolves
+      # it by name — lazily, on the first approval, so no depends_on is needed here.
+      Acl__Objecten__BaseUrl: http://objecten:8000/
+      Acl__Objecten__Token: ${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}
+      Acl__Objecten__ObjecttypenBaseUrl: http://objecttypen:8000/
+      Acl__Objecten__ObjecttypenToken: ${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}
+      Acl__Objecten__ObjecttypeName: RegisterRecord
     ports:
       - "8100:8080"
     healthcheck: