fix(audit): stop writing a BSN into the authz audit Resource (RB-02)

Program.cs built the BIG-nummer reveal's audit resource ref as
"brief/" + ctx.Zorgverlener().Bsn. AuditAuthz persists that to the
AuthzAudit.Resource column in SQLite and /admin/audit renders it, so a BSN
reached durable storage and a UI on the one trail four documents describe as
data-minimised and PII-free — on the endpoint whose own comment promises the
audit carries no PII.

The ref is now "brief". Nothing is lost: BriefStore keys one brief per owner,
so the id named what the row's acting principal already implies.

The existing guard, The_audit_schema_carries_no_pii, asserts on column names,
so a BSN inside a column called Resource could never fail it. Added
No_audit_row_carries_a_subjects_bsn, which drives a denied reveal as a
non-default subject and scans every string field of every row for that BSN
and for DemoOwner — asserting on the two BSNs actually in play rather than a
\d{9} shape, since a hex correlation id can hold nine digits by chance.
Verified it goes red when only the Program.cs line is reverted.

AuditEntry.Actor on document audit rows holds a raw BSN too; that is a
different store and stays with RB-04.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Program.cs

@@ -681,7 +681,10 @@ api.MapPost("/brief/reveal-bignummer", (HttpContext ctx) =>
   var canReveal = Authz.CanRevealBigNummer(principal);
   var steppedUp = ctx.Request.Headers["X-Step-Up"] == "true";
   var allowed = canReveal && steppedUp;
-  AuditAuthz(ctx, "brief:reveal-bignummer", "brief/" + ctx.Zorgverlener().Bsn, allowed, principal);
+  // RB-02/BIO-008: the resource ref is the brief, not the subject — a BSN concatenated
+  // here lands in a persisted, admin-visible column the "no PII" guarantee covers. One
+  // brief exists per owner, so the id added nothing the acting principal did not imply.
+  AuditAuthz(ctx, "brief:reveal-bignummer", "brief", allowed, principal);
   if (!allowed)
     return Results.Problem(
         detail: canReveal