backend phase 13 & frontend phase 6

server/src/Infrastructure/Baya.Infrastructure.Persistence/ApplicationDbContext.cs

@@ -165,5 +165,12 @@ public class ApplicationDbContext: IdentityDbContext<User, Role, int, UserClaim,
         {
             builder.Property(g => g.ConfigJson).HasConversion(encrypted);
         });
+
+        // b13 payout snapshot: the nurse's IBAN is frozen onto each payout at build time and encrypted at rest
+        // through the same seam. Reads mask it to the last 4 digits — the plaintext IBAN is never serialized.
+        modelBuilder.Entity<Baya.Domain.Entities.Payouts.NursePayout>(builder =>
+        {
+            builder.Property(p => p.IbanSnapshot).HasConversion(encrypted);
+        });
     }
 }