Theses with a URN identifier should not be allowed to be hidden

[mmo]

Context

Each document has a masked field with three possible values:

• not_masked (public)
• masked_for_all (hidden from the public UI)
• masked_for_external_ips (restricted to the organisation's IP range)

When a thesis receives a URN identifier (type bf:Urn in identifiedBy), it is
submitted to the Swiss National Library and registered at the DNB resolver. These
documents must remain publicly accessible.

Expected behavior

A document with a bf:Urn identifier must not have masked set to masked_for_all
or masked_for_external_ips. This should be enforced:

1. API level: marshmallow validation should reject updates that set masked to
   anything other than not_masked when a bf:Urn identifier is present.
2. UI level (sonar-ui): the masked field should be disabled or locked to
   not_masked when the document has a bf:Urn identifier.

Notes

• Documents that already have a URN and are currently hidden should be flagged
  (or a data migration script should reset them to not_masked).
• The constraint applies at the document level (not the file level — files may
  still be under embargo).