feat(privacy): WP-40 — PII kernel (Bsn value object + masked-value atom)

Branded Bsn value object with the elfproef (11-test) checksum in shared/kernel/bsn.ts,
wired into the DigiD login boundary so login does real BSN validation (hint + e2e BSNs
updated to a valid 123456782). Consolidate the pure maskers into shared/kernel/pii.ts
(maskBsn/maskTail/REDACTED); debug-state keeps redactProfile (needs the registratie
BigProfile — boundary). New <app-masked-value> atom (+story) centralises the masked
`.includes('*')` detection + reveal affordance; behandel-scherm refactored onto it.
Session.bsn stays string (persistence boundary drops it for privacy). +specs for bsn/pii.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/locale/messages.en.xlf

@@ -6,8 +6,24 @@
         <source>Voer een geldig BSN van 9 cijfers in.</source>
         <target datatype="html">Enter a valid 9-digit BSN.</target>
         <context-group purpose="location">
-          <context context-type="sourcefile">src/app/auth/infrastructure/digid.adapter.ts</context>
-          <context context-type="linenumber">13</context>
+          <context context-type="sourcefile">src/app/shared/kernel/bsn.ts</context>
+          <context context-type="linenumber">15</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="validation.bsnElfproef" datatype="html">
+        <source>Dit is geen geldig BSN (klopt niet met de elfproef).</source>
+        <target datatype="html">This is not a valid BSN (fails the eleven-test checksum).</target>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/shared/kernel/bsn.ts</context>
+          <context context-type="linenumber">20</context>
+        </context-group>
+      </trans-unit>
+      <trans-unit id="maskedValue.reveal" datatype="html">
+        <source>Tonen</source>
+        <target datatype="html">Show</target>
+        <context-group purpose="location">
+          <context context-type="sourcefile">src/app/shared/ui/masked-value/masked-value.component.ts</context>
+          <context context-type="linenumber">27</context>
         </context-group>
       </trans-unit>
       <trans-unit id="form.verplichteVelden" datatype="html">
@@ -35,8 +51,8 @@
         </context-group>
       </trans-unit>
       <trans-unit id="login.bsnDescription" datatype="html">
-        <source>9 cijfers (demo: vul iets in)</source>
-        <target datatype="html">9 digits (demo: fill in anything)</target>
+        <source>9-cijferig BSN, elfproef-geldig (demo: 123456782)</source>
+        <target datatype="html">9-digit BSN, valid eleven-test checksum (demo: 123456782)</target>
         <context-group purpose="location">
           <context context-type="sourcefile">src/app/auth/ui/login-form/login-form.component.ts</context>
           <context context-type="linenumber">25,28</context>