feat(infra): wire OpenZaak → Open Notificaties notifications (refs #56)

Completes the S-01-c wiring so a zaak created in OpenZaak is published to NRC:

- OpenZaak: a zgw_consumers 'nrc' service + notifications_config (setup_configuration),
  publishing as big-reference-seed. NOTIFICATIONS_DISABLED stays true for OpenZaak-only
  bring-ups (OZ_NOTIFICATIONS_DISABLED) so the ACL integration test doesn't 500; the
  full/local stacks and stack-up set it false.
- NRC: the JWT credential, an 'ac' service + autorisaties_api delegation to OpenZaak's
  Autorisaties API, and the 'zaken' kanaal. nrc-init now runs setup_configuration; its
  data.yaml is delivered via the rr-nrc-config volume (seed-config.sh nrc), mirroring oz.
- nrc-beat added to every stack: NRC accepts a notification then drains it via a
  scheduled execute_notifications task — without beat, nothing is delivered. Interval 5s.

Applied across the standalone, full, and local-bind-mount composes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -62,7 +62,10 @@ services:
       CELERY_BROKER_URL: redis://oz-redis:6379/1
       CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
       DISABLE_2FA: "true"
-      NOTIFICATIONS_DISABLED: "true"
+      # Publish notifications to NRC (always present in this full stack). The NRC
+      # service + notifications_config are provisioned by setup_configuration
+      # (infra/openzaak/setup_configuration/data.yaml). See ADR-0007 / S-01-c.
+      NOTIFICATIONS_DISABLED: "false"
       OPENZAAK_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENZAAK_SUPERUSER_EMAIL: admin@localhost
@@ -146,11 +149,17 @@ services:
       OPENNOTIFICATIES_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENNOTIFICATIES_SUPERUSER_EMAIL: admin@localhost
-    # Migrations only for now. No setup_configuration steps are enabled yet (the
-    # OZ<->NRC notification wiring lands in S-06), and NRC's `setup_configuration`
-    # aborts with "No steps enabled" on the empty data.yaml — so we run `migrate`
-    # directly instead of /setup_configuration.sh. See data.yaml and ADR-0002.
-    command: ["sh", "-c", "/wait_for_db.sh && OTEL_SDK_DISABLED=True python src/manage.py migrate"]
+      RUN_SETUP_CONFIG: "true"
+      # nrc-beat fires `execute_notifications` this often to drain scheduled
+      # notifications to subscribers (upstream default 20s). See ADR-0007.
+      NOTIFICATION_SEC_INTERVAL: "5"
+    # Runs migrations + setup_configuration (S-01-c): the JWT credential, the
+    # Autorisaties-API delegation, and the `zaken` kanaal that let OpenZaak publish.
+    # data.yaml is streamed into rr-nrc-config by infra/seed-config.sh (bind mounts
+    # don't reach sibling containers on the CI runner). See data.yaml + ADR-0007.
+    command: /setup_configuration.sh
+    volumes:
+      - nrc-config:/app/setup_configuration:ro
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -185,6 +194,18 @@ services:
         condition: service_completed_successfully
     networks: [cg]
 
+  # Celery beat drains the ScheduledNotification rows the API creates on publish
+  # and hands them to the worker. Without it, notifications are accepted but never
+  # delivered to subscribers — required, not optional. See ADR-0007.
+  nrc-beat:
+    image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
+    environment: *nrc-env
+    command: /celery_beat.sh
+    depends_on:
+      nrc-init:
+        condition: service_completed_successfully
+    networks: [cg]
+
   # ── Keycloak (S-02) ──────────────────────────────────────────────────────
   keycloak:
     image: quay.io/keycloak/keycloak:26.1
@@ -309,6 +330,9 @@ volumes:
   oz-config:
     external: true
     name: rr-oz-config
+  nrc-config:
+    external: true
+    name: rr-nrc-config
   kc-realms:
     external: true
     name: rr-kc-realms