feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -185,12 +185,12 @@ degrade to an instant navigation.
 
 ### Dependency security
 
-The **shipped app has 0 known vulnerabilities** (`npm audit --omit=dev`). All advisories
-live in dev/build tooling (Storybook + the Angular build chain) and never reach the
-bundle. `package.json` `overrides` pin patched transitive versions, taking the full
-audit from 16 (incl. 3 high) down to **5 low** — the remainder all cascade from
-`@babel/core`'s low-severity sourceMappingURL issue, which only "fixes" by jumping to
-Babel 8 (a breaking change across the Storybook/Babel chain) and is deliberately left.
+The **shipped app has 0 known vulnerabilities** (`npm audit --omit=dev`) — and, since the
+`@babel/core` pin below, the **full dev audit is 0 too**. All advisories live(d) in
+dev/build tooling (Storybook + the Angular build chain) and never reach the bundle.
+`package.json` `overrides` pin patched transitive versions; the last remaining cluster
+cascaded from `@babel/core`'s low-severity sourceMappingURL issue, closed by pinning
+`@babel/core` to a patched **7.x** (`^7.29.7`) — no jump to Babel 8, no breaking change.
 We do **not** run `npm audit fix --force`: its proposed fix downgrades Angular 22 → 21.
 
 ### Deliberately out of scope (POC)