ci(infra): run the Event Subscriber + projection-api in compose and verify end-to-end (refs #7)

Add projection-db + the two services to both compose files (host ports 8110/8120), their
Dockerfiles (repo-root context — they share Projection.ReadModel), and a runner-safe
verify-projection check (infra/run-projection-check.sh) that registers the abonnement at the
real subscriber, creates a zaak and asserts projection-api serves an INGEDIEND row. Wire it
into make (verify-projection, verify, WAIT_SVCS) and the CI verify-stack job, and run the
event-subscriber Stryker ratchet in `make mutation` + upload its report.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.yml

@@ -9,6 +9,8 @@
 #   8080  BFF               GET /health → Healthy
 #   8090  Flowable REST     http://localhost:8090/flowable-rest/service/
 #   8100  ACL               GET /health → Healthy  POST /zaken
+#   8110  Event Subscriber  GET /health → Healthy  POST /notifications
+#   8120  projection-api    GET /health → Healthy  GET /register
 #   8180  Keycloak          (admin: admin / admin)
 #
 #   docker compose -f infra/docker-compose.yml up -d --build --wait
@@ -320,10 +322,76 @@ services:
       start_period: 10s
     networks: [cg]
 
+  # ── Read projection (S-06) ────────────────────────────────────────────────
+  # One Postgres DB backing the rebuildable read projection (PRD §8.4): the Event
+  # Subscriber writes it, projection-api reads it. See ADR-0008.
+  projection-db:
+    image: docker.io/library/postgres:16
+    environment:
+      POSTGRES_USER: projection
+      POSTGRES_PASSWORD: projection
+      POSTGRES_DB: projection
+    volumes:
+      - projection-db:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U projection -d projection"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks: [cg]
+
+  # Consumes NRC notifications (abonnement callback) and projects zaak-created events
+  # into register_projection. Build context is the repo root: it shares the read model
+  # in services/projection-api/Projection.ReadModel.
+  event-subscriber:
+    build:
+      context: ..
+      dockerfile: services/event-subscriber/Dockerfile
+    image: register-referentie/event-subscriber:dev
+    environment:
+      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
+      # The bearer Open Notificaties must present on the abonnement callback. NRC's
+      # registration probe expects a 401 without it (ADR-0007). Dev-only token.
+      EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
+    ports:
+      - "8110:8080"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 15s
+    depends_on:
+      projection-db:
+        condition: service_healthy
+    networks: [cg]
+
+  # The read side of the projection. Shares Projection.ReadModel, so build context is root.
+  projection-api:
+    build:
+      context: ..
+      dockerfile: services/projection-api/Dockerfile
+    image: register-referentie/projection-api:dev
+    environment:
+      ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
+    ports:
+      - "8120:8080"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+      start_period: 15s
+    depends_on:
+      projection-db:
+        condition: service_healthy
+    networks: [cg]
+
 volumes:
   oz-db:
   nrc-db:
   flowable-db:
+  projection-db:
   # Config volumes — created and populated out-of-band by infra/seed-config.sh
   # (docker cp), because bind mounts don't reach sibling containers on the CI
   # runner. `external` keeps the names deterministic; the seed step manages them.