feat(acl): set and read the zaak identificatie as the citizen reference (refs #78)

The ACL now writes the domain registrationId as the zaak's identificatie on
POST /zaken, and exposes GET-through POST /zaken/reference to read a zaak's
identificatie back. Only the ACL touches ZGW (§8.1); the reference is the single
value shown on both the self-service confirmation and the openbaar register.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Api/Program.cs

@@ -20,7 +20,7 @@ app.MapGet("/health", () => "Healthy");
 // The ACL's single operation, exposed as a service endpoint.
 app.MapPost("/zaken", async (OpenZaakRequest body, AclService acl, CancellationToken ct) =>
 {
-    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn), ct);
+    var zaakUrl = await acl.OpenZaakAsync(new DomainRegistration(body.Bsn, body.Reference), ct);
     return Results.Ok(new { zaakUrl = zaakUrl.ToString() });
 });
 
@@ -32,10 +32,20 @@ app.MapPost("/statussen", async (SetStatusRequest body, AclService acl, Cancella
     return Results.NoContent();
 });
 
+// Read a zaak's public-safe reference (its identificatie). The Event Subscriber calls this to enrich
+// the read projection without reading ZGW itself (§8.1, #78).
+app.MapPost("/zaken/reference", async (ZaakReferenceRequest body, AclService acl, CancellationToken ct) =>
+{
+    var reference = await acl.GetZaakReferenceAsync(new Uri(body.ZaakUrl), ct);
+    return Results.Ok(new { reference });
+});
+
 app.Run();
 
-public sealed record OpenZaakRequest(string Bsn);
+public sealed record OpenZaakRequest(string Bsn, string Reference);
 
 public sealed record SetStatusRequest(string ZaakUrl);
 
+public sealed record ZaakReferenceRequest(string ZaakUrl);
+
 public partial class Program;