feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/BriefEndpointTests.cs

@@ -68,12 +68,48 @@ public class BriefEndpointTests(TestWebApplicationFactory factory) : IClassFixtu
     Assert.Contains(view.AvailablePassages, p => p.Besluit == "negatief" && p.Reason == "onvoldoende_scholing");
 
     // Case context is joined onto the screen DTO for the behandel scherm header.
-    Assert.Equal("19012345601", view.CaseContext.BigNummer);
+    // The BIG-nummer ships MASKED by default (PRD-0002 §5c) — reveal is a separate call.
+    Assert.Equal("********601", view.CaseContext.BigNummer);
     Assert.Equal("arts", view.CaseContext.Beroep);
     Assert.False(string.IsNullOrWhiteSpace(view.CaseContext.ZorgverlenerNaam));
     Assert.False(string.IsNullOrWhiteSpace(view.CaseContext.AanvraagReferentie));
   }
 
+  // --- Field-level PII reveal (PRD-0002 §5c/§5d, phase P2) ---
+
+  [Fact]
+  public async Task Reveal_returns_the_unmasked_BIG_nummer_for_the_drafter_with_step_up()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
+    req.Headers.Add("X-Step-Up", "true"); // no X-Role → drafter (the capable role)
+    var res = await _client.SendAsync(req);
+
+    Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+    var body = await res.Content.ReadFromJsonAsync<RevealBigNummerResponse>();
+    Assert.Equal("19012345601", body!.BigNummer);
+  }
+
+  [Fact]
+  public async Task Reveal_is_forbidden_without_the_step_up()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer"); // drafter, no step-up
+    var res = await _client.SendAsync(req);
+    Assert.Equal(HttpStatusCode.Forbidden, res.StatusCode);
+  }
+
+  [Fact]
+  public async Task Reveal_is_forbidden_for_a_role_without_the_capability()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
+    req.Headers.Add("X-Role", "approver");
+    req.Headers.Add("X-Step-Up", "true"); // capability missing → still denied
+    var res = await _client.SendAsync(req);
+    Assert.Equal(HttpStatusCode.Forbidden, res.StatusCode);
+  }
+
   [Fact]
   public async Task Save_is_drafter_only()
   {