feat(infra): Open Notificaties up + shared network with OpenZaak (closes #2)

Add infra/opennotificaties/docker-compose.yml (PostGIS db, redis broker,
migrate-init, API, celery worker) on a shared `cg` network with the
OpenZaak stack (renamed oz->cg), published on host :8001. Add combined
`make stack-up/stack-smoke/stack-down` targets and a runbook.

Completes S-01's acceptance: OpenZaak + Open Notificaties + Postgres come
up in compose and a health check confirms all reachable (OZ 403/302/200,
NRC 302; cross-network DNS verified). Catalogus seed landed in S-01-b.

OZ->NRC notification *delivery* wiring (NRC setup_configuration: Services +
Authorization + JWT + Kanalen + Abonnementen; OZ NotificationConfig; re-
enabling NOTIFICATIONS_DISABLED) is deferred to S-06 (Event Subscriber),
the slice that consumes events. NRC data.yaml is migrate-only until then.

Verified: `make stack-smoke` green (both platforms reachable).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/openzaak/docker-compose.yml

@@ -22,11 +22,11 @@ services:
       interval: 5s
       timeout: 3s
       retries: 10
-    networks: [oz]
+    networks: [cg]
 
   oz-redis:
     image: docker.io/library/redis:7
-    networks: [oz]
+    networks: [cg]
 
   oz-init:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
@@ -61,7 +61,7 @@ services:
         condition: service_healthy
       oz-redis:
         condition: service_started
-    networks: [oz]
+    networks: [cg]
 
   openzaak:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
@@ -77,7 +77,7 @@ services:
     depends_on:
       oz-init:
         condition: service_completed_successfully
-    networks: [oz]
+    networks: [cg]
 
   oz-celery:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-latest}
@@ -86,10 +86,10 @@ services:
     depends_on:
       oz-init:
         condition: service_completed_successfully
-    networks: [oz]
+    networks: [cg]
 
 volumes:
   oz-db:
 
 networks:
-  oz:
+  cg: