fix(privacy): mask the owner BSN on the cross-owner case lists (RB-03)

Mappers.ToAdminSummaryDto set Owner to the raw BSN. Both consumers are
cross-owner lists read by someone who is not the subject — GET /admin/cases
and GET /werkvoorraad — while GET /beoordeling/{id}, the detail view of the
same data, already masked it. The detail screen showed ******782 and the list
one click earlier showed the whole thing.

Masked in the mapper rather than at each endpoint, so a third cross-owner
list cannot be added that forgets to.

MaskTail moves out of Program.cs into Domain/People/Pii.cs: it now has
callers in Contracts, Program.cs and (once RB-04 lands) Data, and a second
hand-rolled copy is how one of them drifts into leaking. Documented as
idempotent, which is what lets /beoordeling/{id} keep its own call —
IZaakSource has a second implementation whose Owner is mapped from the
OpenZaak zaak identificatie, so that endpoint should not depend on which
source answered.

No frontend change: all three consumers display the value, and the parse
boundaries only require a non-empty string.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/WerkvoorraadTests.cs

@@ -38,7 +38,8 @@ public class WerkvoorraadTests(TestWebApplicationFactory factory) : IClassFixtur
       var queue = (await res.Content.ReadFromJsonAsync<List<ApplicationSummaryDto>>())!;
       var mine = queue.Single(x => x.Id == a.Id);
       Assert.Equal("InBehandeling", mine.Status.Tag);
-      Assert.False(string.IsNullOrEmpty(mine.Owner)); // cross-owner, like /admin/cases
+      // RB-03/BIO-003: masked, like /admin/cases — both inherit ToAdminSummaryDto.
+      Assert.Equal("******782", mine.Owner);
     }
     finally
     {