feat(acl): set and read the zaak identificatie as the citizen reference (refs #78)

The ACL now writes the domain registrationId as the zaak's identificatie on
POST /zaken, and exposes GET-through POST /zaken/reference to read a zaak's
identificatie back. Only the ACL touches ZGW (§8.1); the reference is the single
value shown on both the self-service confirmation and the openbaar register.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/acl/Acl.Application/IZaakGateway.cs

@@ -12,4 +12,8 @@ public interface IZaakGateway
     /// the catalogus and POSTs a status against the zaak, dated <paramref name="datumStatusGezet"/>.
     /// </summary>
     Task SetZaakToEindstatusAsync(Uri zaakUrl, Uri zaaktypeUrl, DateOnly datumStatusGezet, CancellationToken ct = default);
+
+    /// <summary>Read the zaak's <c>identificatie</c> — the public-safe reference the register shows.
+    /// The Event Subscriber calls this through the ACL rather than reading ZGW itself (§8.1, #78).</summary>
+    Task<string> GetZaakIdentificatieAsync(Uri zaakUrl, CancellationToken ct = default);
 }