feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/app.routes.ts

@@ -1,6 +1,6 @@
 import { Routes } from '@angular/router';
 import { ShellComponent } from '@shared/layout/shell/shell.component';
-import { authGuard } from '@auth/auth.guard';
+import { authGuard, capabilityGuard } from '@auth/auth.guard';
 
 export const routes: Routes = [
   {
@@ -53,7 +53,10 @@ export const routes: Routes = [
       },
       {
         path: 'brief/huisstijl',
-        canActivate: [authGuard],
+        // Admin-only org-template editor (WP-26): capabilityGuard denies-by-default
+        // unless GET /me resolved `orgtemplate:edit` (Admin role). Backend re-enforces
+        // via the OrgAdmin gate — the guard just avoids loading a page that would 403.
+        canActivate: [capabilityGuard('orgtemplate:edit')],
         loadComponent: () =>
           import('@brief/ui/org-template.page').then((m) => m.OrgTemplatePage),
       },