feat(privacy): WP-40 — PII kernel (Bsn value object + masked-value atom)

Branded Bsn value object with the elfproef (11-test) checksum in shared/kernel/bsn.ts,
wired into the DigiD login boundary so login does real BSN validation (hint + e2e BSNs
updated to a valid 123456782). Consolidate the pure maskers into shared/kernel/pii.ts
(maskBsn/maskTail/REDACTED); debug-state keeps redactProfile (needs the registratie
BigProfile — boundary). New <app-masked-value> atom (+story) centralises the masked
`.includes('*')` detection + reveal affordance; behandel-scherm refactored onto it.
Session.bsn stays string (persistence boundary drops it for privacy). +specs for bsn/pii.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/error-state.spec.ts

@@ -12,7 +12,7 @@ import { expect, test } from '@playwright/test';
 // here: a real reload cycle, not a no-op button.
 test('dashboard error state renders, retry re-fetches (and fails again)', async ({ page }) => {
   await page.goto('/login');
-  await page.getByLabel('BSN').fill('123456789');
+  await page.getByLabel('BSN').fill('123456782');
   await page.getByRole('button', { name: 'Inloggen met DigiD' }).click();
   await expect(page).toHaveURL(/\/dashboard$/);
 

e2e/smoke.spec.ts

@@ -12,7 +12,7 @@ import { expect, test } from '@playwright/test';
 // stricter future test might.
 test('login → dashboard → registratie wizard → submitted', async ({ page }) => {
   await page.goto('/login');
-  await page.getByLabel('BSN').fill('123456789');
+  await page.getByLabel('BSN').fill('123456782');
   await page.getByLabel('Wachtwoord').fill('demo');
   await page.getByRole('button', { name: 'Inloggen met DigiD' }).click();