feat(1099): add ITinProtector with Data Protection encryption + last-4 helper

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API/ROLAC.API/Services/Security/ITinProtector.cs

@@ -0,0 +1,8 @@
+namespace ROLAC.API.Services.Security;
+
+/// <summary>Reversible protection for taxpayer identification numbers (SSN/EIN).</summary>
+public interface ITinProtector
+{
+    string Protect(string plaintext);
+    string Unprotect(string ciphertext);
+}

API/ROLAC.API/Services/Security/TinProtector.cs

@@ -0,0 +1,22 @@
+using Microsoft.AspNetCore.DataProtection;
+
+namespace ROLAC.API.Services.Security;
+
+public class TinProtector : ITinProtector
+{
+    private readonly IDataProtector _protector;
+
+    public TinProtector(IDataProtectionProvider provider)
+        => _protector = provider.CreateProtector("Payee1099.Tin");
+
+    public string Protect(string plaintext)    => _protector.Protect(plaintext);
+    public string Unprotect(string ciphertext) => _protector.Unprotect(ciphertext);
+
+    /// <summary>Last four digits of a TIN (ignoring dashes/spaces); null/empty in => null.</summary>
+    public static string? Last4(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return null;
+        var digits = new string(raw.Where(char.IsDigit).ToArray());
+        return digits.Length <= 4 ? digits : digits[^4..];
+    }
+}