feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/brief/infrastructure/brief.adapter.ts

@@ -314,7 +314,8 @@ function parseDecisions(dto: BriefDecisionsDto | undefined): Result<string, Brie
     typeof dto?.canEdit !== 'boolean' ||
     typeof dto.canApprove !== 'boolean' ||
     typeof dto.canReject !== 'boolean' ||
-    typeof dto.canSend !== 'boolean'
+    typeof dto.canSend !== 'boolean' ||
+    typeof dto.canRevealBigNummer !== 'boolean'
   ) {
     return err('brief-view: missing/invalid decisions');
   }
@@ -323,6 +324,7 @@ function parseDecisions(dto: BriefDecisionsDto | undefined): Result<string, Brie
     canApprove: dto.canApprove,
     canReject: dto.canReject,
     canSend: dto.canSend,
+    canRevealBigNummer: dto.canRevealBigNummer,
   });
 }