feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/AuthzTests.cs

@@ -65,4 +65,20 @@ public class AuthzTests
     Assert.Empty(Authz.RoleCapabilities(Drafter));
     Assert.Equal(new[] { "brief:approve", "brief:reject", "brief:send" }, Authz.RoleCapabilities(Approver));
   }
+
+  [Fact]
+  public void CanRevealBigNummer_only_for_the_case_drafter_behandelaar()
+  {
+    Assert.True(Authz.CanRevealBigNummer(Drafter));
+    Assert.False(Authz.CanRevealBigNummer(Approver));
+  }
+
+  [Fact]
+  public void Decisions_CanRevealBigNummer_is_status_independent()
+  {
+    // Unlike the action gates, PII reveal does not depend on the brief's status.
+    Assert.True(Authz.Decisions(Drafter, "draft", DrafterId).CanRevealBigNummer);
+    Assert.True(Authz.Decisions(Drafter, "sent", DrafterId).CanRevealBigNummer);
+    Assert.False(Authz.Decisions(Approver, "draft", DrafterId).CanRevealBigNummer);
+  }
 }