feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/brief/application/brief.store.spec.ts

@@ -5,6 +5,7 @@ import { Brief, BriefDecisions, CaseContext, LetterBlock } from '@brief/domain/b
 import { OrgTemplate } from '@brief/domain/org-template';
 import { BriefAdapter, BriefView } from '@brief/infrastructure/brief.adapter';
 import { LetterPreviewAdapter } from '@brief/infrastructure/letter-preview.adapter';
+import { RevealBigNummerAdapter } from '@brief/infrastructure/reveal-bignummer.adapter';
 import { BriefStore } from './brief.store';
 
 const decisions: BriefDecisions = {
@@ -12,6 +13,7 @@ const decisions: BriefDecisions = {
   canApprove: true,
   canReject: true,
   canSend: true,
+  canRevealBigNummer: true,
 };
 
 const brief: Brief = {
@@ -249,3 +251,37 @@ describe('BriefStore.previewLetter', () => {
     expect(store.lastError()).toBe('De voorvertoning kon niet worden geopend.');
   });
 });
+
+describe('BriefStore.revealBigNummer (PRD-0002 §5c)', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  // Loaded with a MASKED BIG-nummer, as the server ships it by default.
+  const maskedView: BriefView = { ...view, caseContext: { ...caseContext, bigNummer: '********601' } };
+
+  it('swaps the masked value for the revealed one on success', async () => {
+    const store = setup({ load: () => Promise.resolve({ ok: true, value: maskedView }) });
+    await store.load();
+    expect(store.caseContext()?.bigNummer).toBe('********601');
+    vi.spyOn(TestBed.inject(RevealBigNummerAdapter), 'reveal').mockResolvedValue({
+      ok: true,
+      value: '19012345601',
+    });
+
+    await store.revealBigNummer();
+    expect(store.caseContext()?.bigNummer).toBe('19012345601');
+    expect(store.lastError()).toBeNull();
+  });
+
+  it('keeps the value masked and surfaces the error on failure', async () => {
+    const store = setup({ load: () => Promise.resolve({ ok: true, value: maskedView }) });
+    await store.load();
+    vi.spyOn(TestBed.inject(RevealBigNummerAdapter), 'reveal').mockResolvedValue({
+      ok: false,
+      error: 'geweigerd',
+    });
+
+    await store.revealBigNummer();
+    expect(store.caseContext()?.bigNummer).toBe('********601'); // unchanged
+    expect(store.lastError()).toBe('geweigerd');
+  });
+});