feat(brief): WP-18 — ABAC capability spine (PRD-0002 phase P1)

Replace the FE-computed authorization anti-pattern in BriefStore.editable
(derived from the unverified X-Role header) with server-computed decision
flags, mirroring the existing HerregistratieDecisionsDto pattern:

- Backend: Authz.cs is the single authorization helper — the SAME check
  (Authz.CanActOn) both gates BriefStore.Review's mutations and computes
  the BriefDecisionsDto flags shipped on every brief response, so emit
  and enforce can never drift. New GET /me returns coarse, role-derived
  capabilities (PRD-0002 SS6).
- Every brief endpoint (including send, previously ungated on HttpContext)
  now returns a fresh BriefViewDto so decisions never go stale after a
  mutation.
- FE: brief.store.ts reads canEdit/canApprove/canReject/canSend off the
  loaded decisions instead of computing them from currentRole(); the
  brief.machine carries decisions through every status transition.
- New shared/domain/capability.ts + shared/application/access.store.ts +
  shared/infrastructure/me.adapter.ts: the general capability-spine
  infrastructure (AccessStore.can(), capabilityGuard) for future routes.

Deviates from the original WP-18 draft by NOT renaming auth/domain's
Session to a Principal union — ADR-0002 explicitly defers that refactor
until a second actor exists, and the brief workflow's drafter/approver
identity turned out to be a separate axis from the SSP login session
entirely. See docs/backlog/WP-18-abac-capability-spine.md for the full
as-built record.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/BriefStore.cs

@@ -1,4 +1,5 @@
 using BigRegister.Api.Contracts;
+using BigRegister.Domain.Authorization;
 
 namespace BigRegister.Api.Data;
 
@@ -72,11 +73,13 @@ public static class BriefStore
     }
   }
 
-  public static (Outcome, BriefEntity?) Approve(string owner, string actingId, string at) =>
-      Review(owner, actingId, e => new BriefStatusDto("approved", ApprovedBy: actingId, ApprovedAt: at));
+  public static (Outcome, BriefEntity?) Approve(string owner, Principal principal, string at) =>
+      Review(owner, principal, BriefAction.Approve, () =>
+          new BriefStatusDto("approved", ApprovedBy: Authz.ActingId(principal), ApprovedAt: at));
 
-  public static (Outcome, BriefEntity?) Reject(string owner, string actingId, string comments, string at) =>
-      Review(owner, actingId, e => new BriefStatusDto("rejected", RejectedBy: actingId, RejectedAt: at, Comments: comments));
+  public static (Outcome, BriefEntity?) Reject(string owner, Principal principal, string comments, string at) =>
+      Review(owner, principal, BriefAction.Reject, () =>
+          new BriefStatusDto("rejected", RejectedBy: Authz.ActingId(principal), RejectedAt: at, Comments: comments));
 
   public static (Outcome, BriefEntity?) Send(string owner, string at)
   {
@@ -109,15 +112,18 @@ public static class BriefStore
   }
 
   // Approve/reject share the guard: must be submitted, and the approver must differ
-  // from the drafter (a drafter cannot approve their own letter).
-  private static (Outcome, BriefEntity?) Review(string owner, string actingId, Func<BriefEntity, BriefStatusDto> next)
+  // from the drafter (a drafter cannot approve their own letter). The SoD check is
+  // Authz.CanActOn — the SAME check the screen DTO's decision flags use — checked
+  // BEFORE the status guard so Forbidden vs Conflict ordering matches the old
+  // inline check exactly.
+  private static (Outcome, BriefEntity?) Review(string owner, Principal principal, BriefAction action, Func<BriefStatusDto> next)
   {
     lock (_gate)
     {
       if (!_byOwner.TryGetValue(owner, out var e)) return (Outcome.Conflict, null);
-      if (actingId == e.DrafterId) return (Outcome.Forbidden, null);
+      if (!Authz.CanActOn(action, principal, e.DrafterId)) return (Outcome.Forbidden, null);
       if (e.Status.Tag != "submitted") return (Outcome.Conflict, null);
-      e.Status = next(e);
+      e.Status = next();
       return (Outcome.Ok, e);
     }
   }