Merge RB-28 — add BLOB_PRESENTER, unlock the blob-to-browser success paths

TE-006: StamdataStore.download(), BriefStore.previewLetter() and
OrgTemplateStore.proefbrief() each ended in raw DOM blob calls jsdom cannot
meaningfully execute, so their success paths were unassertable and
download()'s two-clause guard true-branch was permanently dark.
BLOB_PRESENTER mirrors the SESSION_PORT shape; all three commands go through
it. download()'s branch coverage goes from 40.5% to 67.6%, and
org-template.store.ts gets its first spec at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	docs/project/refactor-backlog-setup/refactor-backlog/99-backlog.md
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -20,7 +20,7 @@ tested where._
 
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
-**is** the suite, reshaped for a business reader. 487 frontend behaviours across
+**is** the suite, reshaped for a business reader. 492 frontend behaviours across
 9 contexts; 261 backend behaviours across 42 test
 classes.
 
@@ -114,6 +114,12 @@ classes.
 - records addRow and undoes it
 - clears history when switching table
 
+#### StamdataStore.download (RB-28)
+
+- does not call the presenter while the two-clause guard blocks (nothing dirty yet)
+- does not call the presenter while previewing a date, even with edits
+- passes toJson(...)'s exact output and the table id as the filename (success path)
+
 #### activeOn (valid-time, half-open [van, tot))
 
 - includes a row whose window covers the date
@@ -187,7 +193,7 @@ classes.
 
 #### BriefStore.previewLetter
 
-- opens the composed letter in a new tab on success
+- opens the composed letter via BLOB_PRESENTER on success (RB-28)
 - surfaces the error without opening a tab on failure
 
 #### BriefStore.revealBigNummer (PRD-0002 §5c)
@@ -200,6 +206,11 @@ classes.
 - sends no X-Role/X-Subject headers outside isDevMode()
 - sends X-Role (and X-Subject when known) under isDevMode()
 
+#### OrgTemplateStore.proefbrief (RB-28)
+
+- opens the rendered proefbrief via BLOB_PRESENTER on success
+- surfaces the error without opening a tab on failure
+
 #### RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)
 
 - sends X-Step-Up only when the caller passes stepUp: true

libs/shared/src/application/blob-presenter.ts

@@ -0,0 +1,37 @@
+import { InjectionToken } from '@angular/core';
+
+/**
+ * A shared seam for handing a generated `Blob` to the browser, WITHOUT the calling
+ * command inlining `URL.createObjectURL`/`window.open`/`document.createElement('a')`
+ * as its own last statement (TE-006) — those calls are unassertable in jsdom because
+ * they are the end of the command, not a value the spec can intercept. A recording
+ * fake satisfies this shape in specs; `realBlobPresenter` is the production default.
+ */
+export interface BlobPresenter {
+  /** Open a blob in a new tab (e.g. a rendered letter preview). Never revokes the
+      object URL — the tab outlives this call, and the POC treats the leak as cheap
+      (see `BriefStore.previewLetter`'s original comment). */
+  open(blob: Blob): void;
+  /** Trigger a browser download of a blob under the given file name, then revoke the
+      object URL once the click has been dispatched. */
+  download(blob: Blob, filename: string): void;
+}
+
+const realBlobPresenter: BlobPresenter = {
+  open(blob: Blob) {
+    window.open(URL.createObjectURL(blob), '_blank');
+  },
+  download(blob: Blob, filename: string) {
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+  },
+};
+
+export const BLOB_PRESENTER = new InjectionToken<BlobPresenter>('BLOB_PRESENTER', {
+  providedIn: 'root',
+  factory: () => realBlobPresenter,
+});