feat(infra): Open Notificaties up + shared network with OpenZaak (closes #2)

Add infra/opennotificaties/docker-compose.yml (PostGIS db, redis broker,
migrate-init, API, celery worker) on a shared `cg` network with the
OpenZaak stack (renamed oz->cg), published on host :8001. Add combined
`make stack-up/stack-smoke/stack-down` targets and a runbook.

Completes S-01's acceptance: OpenZaak + Open Notificaties + Postgres come
up in compose and a health check confirms all reachable (OZ 403/302/200,
NRC 302; cross-network DNS verified). Catalogus seed landed in S-01-b.

OZ->NRC notification *delivery* wiring (NRC setup_configuration: Services +
Authorization + JWT + Kanalen + Abonnementen; OZ NotificationConfig; re-
enabling NOTIFICATIONS_DISABLED) is deferred to S-06 (Event Subscriber),
the slice that consumes events. NRC data.yaml is migrate-only until then.

Verified: `make stack-smoke` green (both platforms reachable).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -8,8 +8,11 @@
 SLN        := services/bff/Bff.slnx
 COMPOSE    := infra/docker-compose.yml
 HEALTH_URL := http://localhost:8080/health
-OZ_COMPOSE := infra/openzaak/docker-compose.yml
-OZ_BASE    := http://localhost:8000
+OZ_COMPOSE  := infra/openzaak/docker-compose.yml
+OZ_BASE     := http://localhost:8000
+NRC_COMPOSE := infra/opennotificaties/docker-compose.yml
+NRC_BASE    := http://localhost:8001
+STACK_FILES := -f $(OZ_COMPOSE) -f $(NRC_COMPOSE)
 
 # On a rootless Podman dev box, point Docker CLI/Compose at the Podman socket —
 # but only if that socket exists and DOCKER_HOST isn't already set, so real
@@ -21,7 +24,7 @@ export DOCKER_HOST := unix://$(PODMAN_SOCK)
 endif
 endif
 
-.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down help
+.PHONY: ci lint build unit smoke down changelog openzaak-up openzaak-smoke openzaak-seed openzaak-down stack-up stack-smoke stack-down help
 
 ## ci: run the full pipeline — lint, build, unit, smoke (mirrors Gitea Actions)
 ci: lint build unit smoke
@@ -82,6 +85,28 @@ openzaak-seed: openzaak-up
 openzaak-down:
 	docker compose -f $(OZ_COMPOSE) down --volumes
 
+## stack-up: start OpenZaak + Open Notificaties together (shared network)
+stack-up:
+	docker compose $(STACK_FILES) up -d
+
+## stack-smoke: start both, assert OpenZaak (403/302/200) and NRC (302) are reachable
+stack-smoke: stack-up
+	@bash -c 'set -e; \
+	  echo "waiting for OpenZaak + Open Notificaties..."; \
+	  for i in $$(seq 1 60); do \
+	    oz=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/admin/ || true); \
+	    nrc=$$(curl -s -o /dev/null -w "%{http_code}" $(NRC_BASE)/admin/ || true); \
+	    [ "$$oz" = "302" ] && [ "$$nrc" = "302" ] && break; sleep 3; done; \
+	  z=$$(curl -s -o /dev/null -w "%{http_code}" $(OZ_BASE)/zaken/api/v1/zaken); \
+	  echo "OpenZaak /zaken (unauth) -> $$z (expect 403)"; test "$$z" = "403"; \
+	  echo "OpenZaak /admin/         -> $$oz (expect 302)"; test "$$oz" = "302"; \
+	  echo "Open Notificaties /admin/-> $$nrc (expect 302)"; test "$$nrc" = "302"; \
+	  echo "stack smoke OK"'
+
+## stack-down: stop and remove both stacks (wipes data)
+stack-down:
+	docker compose $(STACK_FILES) down --volumes
+
 ## help: list available targets
 help:
 	@grep -E '^## ' $(MAKEFILE_LIST) | sed 's/^## //'