Ash Resource Preparation that applies field masking to read results.

When a field group defines mask and mask_with, this preparation replaces visible field values with masked versions for actors whose field group level specifies masking for those fields.

Masking follows allow-wins semantics: if any of the actor's field groups provides unmasked access to a field, the field is not masked.

How It Works

1. The preparation adds an after_action hook to the query
2. After records are fetched (but before field restriction), the hook:
   • Resolves the actor's field groups from permissions
   • Determines which fields should be masked (allow-wins)
   • Replaces visible field values with masked values
3. Ash's restrict_field_access then runs, hiding truly forbidden fields