fix(audit): stop writing a BSN into the authz audit Resource (RB-02)

Program.cs built the BIG-nummer reveal's audit resource ref as
"brief/" + ctx.Zorgverlener().Bsn. AuditAuthz persists that to the
AuthzAudit.Resource column in SQLite and /admin/audit renders it, so a BSN
reached durable storage and a UI on the one trail four documents describe as
data-minimised and PII-free — on the endpoint whose own comment promises the
audit carries no PII.

The ref is now "brief". Nothing is lost: BriefStore keys one brief per owner,
so the id named what the row's acting principal already implies.

The existing guard, The_audit_schema_carries_no_pii, asserts on column names,
so a BSN inside a column called Resource could never fail it. Added
No_audit_row_carries_a_subjects_bsn, which drives a denied reveal as a
non-default subject and scans every string field of every row for that BSN
and for DemoOwner — asserting on the two BSNs actually in play rather than a
\d{9} shape, since a hex correlation id can hold nine digits by chance.
Verified it goes red when only the Program.cs line is reverted.

AuditEntry.Actor on document audit rows holds a raw BSN too; that is a
different store and stays with RB-04.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/AuthzAuditTests.cs

@@ -43,6 +43,24 @@ public class AuthzAuditTests(TestWebApplicationFactory factory) : IClassFixture<
     Assert.Contains(await AuditLog(), e => e.Action == "brief:reveal-bignummer");
   }
 
+  /// RB-02/BIO-008: the schema test below asserts on **column names**, so a BSN inside a
+  /// column called `Resource` was invisible to it — and one was there, concatenated as
+  /// `"brief/" + Bsn`. This asserts on the stored **values** instead. Four documents
+  /// promise this trail holds no PII; this is the test that makes the promise checkable.
+  [Fact]
+  public async Task No_audit_row_carries_a_subjects_bsn()
+  {
+    const string subject = "999999990";
+    var reveal = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
+    reveal.Headers.Add("X-Subject", subject);
+    Assert.Equal(HttpStatusCode.Forbidden, (await _client.SendAsync(reveal)).StatusCode);
+
+    var bsns = new[] { subject, DocumentStore.DemoOwner };
+    foreach (var e in await AuditLog())
+      foreach (var field in new[] { e.Action, e.Resource, e.Decision, e.Role, e.At, e.CorrelationId })
+        Assert.DoesNotContain(bsns, bsn => field.Contains(bsn, StringComparison.Ordinal));
+  }
+
   [Fact]
   public void The_audit_schema_carries_no_pii()
   {