feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Domain/Authorization/Authz.cs

@@ -64,6 +64,14 @@ public static class Authz
   /// have no per-resource state to weigh, so role IS the whole decision here.
   public static bool CanManageOrgTemplates(Principal principal) => principal.Role == PrincipalRole.Admin;
 
+  /// Field-level PII (PRD-0002 §5c, phase P2): the case screen's BIG-nummer ships
+  /// masked by default; only the behandelaar (Drafter) composing the case — the actor
+  /// whose behandel-scherm shows the field — may reveal it. Role-based in the POC; a
+  /// real system resolves it from the app overlay independent of role. The reveal itself
+  /// is additionally step-up-gated + audited at the endpoint. (Illustrated on the
+  /// BIG-nummer because no BSN travels the wire — see PRD note.)
+  public static bool CanRevealBigNummer(Principal principal) => principal.Role == PrincipalRole.Drafter;
+
   /// Resource-aware decision for the screen DTO: "would this action succeed right
   /// now" — role/SoD AND the brief's current status. This is what the UI renders;
   /// it never re-derives these booleans itself.
@@ -71,5 +79,7 @@ public static class Authz
       CanEdit: principal.Role == PrincipalRole.Drafter && status is "draft" or "rejected",
       CanApprove: CanActOn(BriefAction.Approve, principal, drafterId) && status == "submitted",
       CanReject: CanActOn(BriefAction.Reject, principal, drafterId) && status == "submitted",
-      CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved");
+      CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved",
+      // PII reveal is status-independent (§5c) — unlike the action gates above.
+      CanRevealBigNummer: CanRevealBigNummer(principal));
 }