docs(backlog): add Phase 8 — platform/DX/showcase (WP-37..46)

New phase from the 5-item analysis: linked showcase snippets + animations,
runnable scaffolding generators (pages/wizards/context/SSP), dependency graph +
declarative boundaries, PII hardening (branded Bsn VO + masked-value atom +
persisted no-PII audit) doubling as a privacy showcase, and Vitest coverage.
Goal: both a teaching showcase and a production starter template. Sequenced with
priorities + dependencies in the README.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/WP-42-privacy-security-showcase.md

@@ -0,0 +1,31 @@
+# WP-42 — Privacy & security showcase page
+
+Status: todo
+Phase: 8 — platform/DX/showcase
+Priority: P2
+Depends on: WP-40, WP-41
+
+## Why
+
+Once the reusable privacy pieces exist (WP-40 masked-value atom + pure maskers, WP-41 persisted
+no-PII audit), showcase them as a teaching artifact: how to **mask** and **log** PII safely with FP
+(pure functional core) + atomic design (the masked-value atom), tied to the existing reveal +
+step-up + capability slice.
+
+## Decisions
+
+- A Foundations MDX + a small `showcase` demo (showcase context may read every context).
+- Teach the principles explicitly: data-minimisation, PII out of logs, masked-by-default +
+  audited reveal, server as authority — framed for a Dutch register (AVG art. 9, BIO).
+- Reuse WP-39's linked-snippet mechanism so the shown code can't drift.
+
+## Files
+
+- New `src/docs/privacy-security.mdx` (Foundations).
+- New/extended `showcase` demo wiring `<app-masked-value>`, the pure maskers, and the reveal flow.
+
+## Acceptance criteria
+
+- [ ] Page demonstrates mask + no-PII logging with live components and linked (non-drifting) code.
+- [ ] Explains the register rationale (AVG/BIO/data-minimisation) concisely.
+- [ ] Storybook a11y green; `npm run ci` green.