docs: archive the finished backlogs (RD-30)

Two backlog trees are complete: `docs/project/backlog/` (75 files, every
WP done) and `docs/project/refactor-backlog-setup/` (the arc before it).
Move both under `docs/project/archive/` with `git mv`, so history stays
intact through `git log --follow`. `SHOWCASE-ROADMAP.md` moves with them,
because it points at the now-archived backlog README.

Add `docs/project/archive/README.md`. It states that these trees are
historical and names the two directories that are still live.

Repoint every inbound reference named in RD-30's Files table: CLAUDE.md,
the root README, both backend READMEs, `LetterHtml.cs`, `a11y.mdx`, the
`document-feature` and `new-ssp` skills, and the readable-codebase PLAN,
README, and RD-19 ticket. Fix two upward-relative links inside the moved
WP files (WP-68, WP-69) that gained a directory level and would otherwise
break. Repoint `.prettierignore`'s two agent-prompt exclusions to their
new path, so prettier keeps leaving those files' exact wording alone.

Mark RD-30 done and check off its acceptance criteria; flip its README
row to done.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/project/archive/backlog/WP-42-privacy-security-showcase.md

@@ -0,0 +1,53 @@
+# WP-42 — Privacy & security showcase page
+
+Status: done (optional Foundations MDX writeup left as a nice-to-have)
+
+## Audit view (added after WP-41)
+
+`/beheer/audit` — an admin page (`beheer/ui/audit.page.ts`) reading the WP-41 `GET /admin/audit`
+trail through a `beheer` adapter/store (domain `AuditEntry` + trust-boundary parse), rendered as a
+read-only table (time/action/resource/decision/role/correlation-id), capability-gated on
+`cases:manage`. Added to `ADMIN_LINKS` (so it shows in the header nav + dashboard "Beheer" section)
+and to the `role.interceptor` ROLE_AWARE list (else it silently 403s). This closes the audit half.
+
+Phase: 8 — platform/DX/showcase
+Priority: P2
+Depends on: WP-40, WP-41
+
+## Outcome (mask/parse half — done, on user request ahead of WP-41)
+
+Added a "6 · PII — maskeren & parsen" section to `/concepts` demonstrating the WP-40 pieces with
+FP + atomic design, framed for AVG art. 9 / data-minimisation: a live `<app-masked-value>` atom
+(masked-by-default BSN that reveals on click; note points to the real step-up + audited reveal in
+behandel-scherm) and a live `parseBsn` elfproef parse mirroring the postcode demo. Both show the
+real linked source via the WP-39 snippet mechanism (`// #region showcase:parseBsn` in bsn.ts,
+`showcase:mask` in pii.ts, registered in `gen-snippets.mjs` → `snippets.generated.ts`, drift-gated).
+No i18n (showcase is Dutch-only teaching text). No behaviour change outside the showcase.
+
+**Still pending (needs WP-41):** the "log PII / no-PII audit trail" half — visualizing the
+persisted authz/reveal audit — plus an optional Foundations MDX writeup.
+
+## Why
+
+Once the reusable privacy pieces exist (WP-40 masked-value atom + pure maskers, WP-41 persisted
+no-PII audit), showcase them as a teaching artifact: how to **mask** and **log** PII safely with FP
+(pure functional core) + atomic design (the masked-value atom), tied to the existing reveal +
+step-up + capability slice.
+
+## Decisions
+
+- A Foundations MDX + a small `showcase` demo (showcase context may read every context).
+- Teach the principles explicitly: data-minimisation, PII out of logs, masked-by-default +
+  audited reveal, server as authority — framed for a Dutch register (AVG art. 9, BIO).
+- Reuse WP-39's linked-snippet mechanism so the shown code can't drift.
+
+## Files
+
+- New `src/docs/privacy-security.mdx` (Foundations).
+- New/extended `showcase` demo wiring `<app-masked-value>`, the pure maskers, and the reveal flow.
+
+## Acceptance criteria
+
+- [ ] Page demonstrates mask + no-PII logging with live components and linked (non-drifting) code.
+- [ ] Explains the register rationale (AVG/BIO/data-minimisation) concisely.
+- [ ] Storybook a11y green; `npm run ci` green.