feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -153,7 +153,9 @@ public sealed record BriefDto(
 
 // Decision flags for the CURRENT acting principal + this brief's live status
 // (PRD-0002 phase P1) — the FE renders these, it never recomputes them.
-public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend);
+// CanRevealBigNummer (PRD-0002 §5c): whether the acting principal may unmask the
+// BIG-nummer the case screen ships masked. Status-independent, unlike the action gates.
+public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend, bool CanRevealBigNummer);
 
 // The brief's screen DTO also carries the org template it renders with (WP-23):
 // the sub-org's current PUBLISHED version — or, once sent, the version pinned at
@@ -169,6 +171,9 @@ public sealed record BriefViewDto(
 
 public sealed record SaveBriefRequest(IReadOnlyList<LetterSectionDto> Sections);
 public sealed record RejectBriefRequest(string Comments);
+// The unmasked BIG-nummer, returned only from the audited + step-up-gated reveal
+// endpoint (PRD-0002 §5c). Never logged.
+public sealed record RevealBigNummerResponse(string BigNummer);
 
 // PRD-0002 §6: coarse, role-derived capabilities for nav/menu-level checks.
 public sealed record MeDto(IReadOnlyList<string> Capabilities);