feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/backlog/WP-18-abac-capability-spine.md

@@ -3,6 +3,18 @@
 Status: done (7ec13d8)
 Phase: 5 — productie-volwassenheid
 
+> **Follow-up (P2/P3-lite delivered later).** On top of this P1 spine:
+> - **P2 field-level PII (§5c):** the case screen's **BIG-nummer** now ships masked
+>   (`Authz.CanRevealBigNummer` + `BriefDecisionsDto.CanRevealBigNummer`); a
+>   step-up-stubbed (`X-Step-Up` header), audited `POST /brief/reveal-bignummer` unmasks
+>   it. Realized on the BIG-nummer, not the BSN, because **no BSN travels the wire** (see
+>   PRD-0002 §5c note).
+> - **P3-lite audit + guard (§8, §6):** a no-PII `AuditAuthz` log line records reveal
+>   attempts (allow/deny) and org-admin denials; the already-built `capabilityGuard` is
+>   now wired onto the `brief/huisstijl` admin route.
+>
+> Still unbuilt: data-scoping (§5b), real step-up/MFA, break-glass.
+
 ## Why
 
 The single biggest gap between this POC and a production SSP: identity carries no