feat(infra): wire OpenZaak → Open Notificaties notifications (refs #56)

Completes the S-01-c wiring so a zaak created in OpenZaak is published to NRC:

- OpenZaak: a zgw_consumers 'nrc' service + notifications_config (setup_configuration),
  publishing as big-reference-seed. NOTIFICATIONS_DISABLED stays true for OpenZaak-only
  bring-ups (OZ_NOTIFICATIONS_DISABLED) so the ACL integration test doesn't 500; the
  full/local stacks and stack-up set it false.
- NRC: the JWT credential, an 'ac' service + autorisaties_api delegation to OpenZaak's
  Autorisaties API, and the 'zaken' kanaal. nrc-init now runs setup_configuration; its
  data.yaml is delivered via the rr-nrc-config volume (seed-config.sh nrc), mirroring oz.
- nrc-beat added to every stack: NRC accepts a notification then drains it via a
  scheduled execute_notifications task — without beat, nothing is delivered. Interval 5s.

Applied across the standalone, full, and local-bind-mount composes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/openzaak/docker-compose.yml

@@ -47,9 +47,12 @@ services:
       CELERY_BROKER_URL: redis://oz-redis:6379/1
       CELERY_RESULT_BACKEND: redis://oz-redis:6379/1
       DISABLE_2FA: "true"
-      # Notifications go to Open Notificaties (NRC), which arrives in S-01-c.
-      # Until then, disable outbound notifications so writes don't 500.
-      NOTIFICATIONS_DISABLED: "true"
+      # Notifications are OFF by default so OpenZaak-only bring-ups (openzaak-up,
+      # the ACL integration test) don't 500 trying to reach an absent NRC. When
+      # OpenZaak runs together with the NRC stack, set OZ_NOTIFICATIONS_DISABLED=false
+      # (make stack-up does) to publish; the NRC service + notifications_config that
+      # name it are provisioned by setup_configuration (data.yaml, S-01-c).
+      NOTIFICATIONS_DISABLED: "${OZ_NOTIFICATIONS_DISABLED:-true}"
       OPENZAAK_SUPERUSER_USERNAME: admin
       DJANGO_SUPERUSER_PASSWORD: admin
       OPENZAAK_SUPERUSER_EMAIL: admin@localhost