feat(acl): write the RegisterRecord to Objecten on approval (refs #149)

ApproveZaakAsync now does two writes: the ZGW eindstatus (the process) and the
register record in Objecten (the register). The record is keyed on the zaak
UUID — the same key the read projection rows carry — and its reference is the
zaak's identificatie, so nothing personal crosses into the world-readable
register (ADR-0027).

ObjectenGateway resolves the objecttype by name (its URL and version are
assigned at seed time, as with ADR-0021), searches for an existing object by
data attribute, then POSTs or PATCHes. Resolution is lazy, so the ACL needs no
depends_on on Objecten and does not crash-loop when it boots first.

services/acl/Acl.Api/Program.cs

@@ -42,7 +42,12 @@ builder.Services.AddSingleton<IDefaultFillStore>(sp =>
     return new InMemoryDefaultFillStore(
         new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
 });
+builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
+    .GetSection("Acl:Objecten").Get<ObjectenOptions>()
+    ?? throw new InvalidOperationException("Missing configuration section 'Acl:Objecten'"));
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
+// The Objecten hop that writes the register record on approval (S-19a, ADR-0028).
+builder.Services.AddHttpClient<IRegisterRecordGateway, ObjectenGateway>();
 // Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
 builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
 builder.Services.AddScoped<AclService>();