ci(infra): run the Event Subscriber + projection-api in compose and verify end-to-end (refs #7)

Add projection-db + the two services to both compose files (host ports 8110/8120), their
Dockerfiles (repo-root context — they share Projection.ReadModel), and a runner-safe
verify-projection check (infra/run-projection-check.sh) that registers the abonnement at the
real subscriber, creates a zaak and asserts projection-api serves an INGEDIEND row. Wire it
into make (verify-projection, verify, WAIT_SVCS) and the CI verify-stack job, and run the
event-subscriber Stryker ratchet in `make mutation` + upload its report.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -62,6 +62,12 @@ jobs:
           name: acl-mutation-report
           path: services/acl/StrykerOutput/**/reports/mutation-report.html
           if-no-files-found: warn
+      - uses: https://github.com/actions/upload-artifact@v3
+        if: always()
+        with:
+          name: event-subscriber-mutation-report
+          path: services/event-subscriber/StrykerOutput/**/reports/mutation-report.html
+          if-no-files-found: warn
 
   # One stage for every check that needs the live stack. On the single self-hosted
   # runner jobs run sequentially, so booting OpenZaak once (instead of once per job)
@@ -80,10 +86,12 @@ jobs:
         run: make verify-acl
       - name: OpenZaak → NRC notification delivery
         run: make verify-nrc
+      - name: OpenZaak → NRC → Event Subscriber → projection-api
+        run: make verify-projection
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-init keycloak acl bff 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-init keycloak acl bff projection-db event-subscriber projection-api 2>&1 || true
       - name: Tear down
         if: always()
         run: make down