fix(privacy): mask the BSN recorded as the document audit Actor (RB-04)

DocumentStore wrote one audit row per upload and per user delete carrying the
acting citizen's raw BSN as AuditEntry.Actor, persisted to SQLite — on a
store whose own doc comment says it holds metadata only, never file content
"or other PII". Same shape as RB-02, in a second store.

Masked at the two citizen call sites rather than inside Audit, because the
third actor is the literal "admin" and MaskTail("admin", 3) is "**min";
masking centrally would mean guessing which actors are BSNs and which are
role names. Audit's doc comment now states that actors arrive redacted.

StoredDocument.Owner is untouched: it is the authorization key that
DeleteOwned, ForeignIds and RB-01's content check all compare against, so the
BSN stays where it is load-bearing and leaves the trail where it was only
decoration. No endpoint exposes AuditLog, so no response shape changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -1,3 +1,5 @@
+using BigRegister.Domain.People;
+
 namespace BigRegister.Api.Data;
 
 /// <summary>
@@ -58,7 +60,7 @@ public static class DocumentStore
       db.Documents.Add(doc);
       db.SaveChanges();
     }
-    Audit("upload", doc.DocumentId, categoryId, owner);
+    Audit("upload", doc.DocumentId, categoryId, Pii.MaskTail(owner, 3));
     return doc;
   }
 
@@ -156,7 +158,7 @@ public static class DocumentStore
       db.Documents.Remove(d);
       db.SaveChanges();
     }
-    Audit("delete-user", documentId, categoryId, owner);
+    Audit("delete-user", documentId, categoryId, Pii.MaskTail(owner, 3));
     return DeleteResult.Ok;
   }
 
@@ -178,6 +180,12 @@ public static class DocumentStore
     return true;
   }
 
+  /// <summary>Append one metadata-only audit row. <paramref name="actor"/> must arrive
+  /// **already redacted** (RB-04/BIO-005) — the two citizen call sites pass
+  /// <see cref="Pii.MaskTail"/> of the owner BSN, `delete-admin` passes the literal
+  /// `"admin"`. The unmasked BSN lives only in <see cref="StoredDocument.Owner"/>, which is
+  /// the authorization key and stays untouched. Masking here instead would have to guess
+  /// which actors are BSNs and which are role names.</summary>
   public static void Audit(string action, string documentId, string categoryId, string actor)
   {
     lock (_gate)