fix(brief): keep the dev hatches out of production builds (RB-11)

BIO-012: roleInterceptor/subjectInterceptor are correctly registered
only under isDevMode(), but three hand-written fetch adapters
(reveal-bignummer, letter-preview, org-template's proefbrief) bypass
HttpClient and set X-Role/X-Subject themselves with no guard. The
readers underneath, role.ts and subject.ts, were ungated too: they
read ?role=/?subject= and wrote it into sessionStorage on any
navigation, in any build -- for ?subject= that value is a BSN, which
is exactly what SessionStore's G1 comment promises never happens.

Gate both layers: currentRole()/currentSubject() return their safe
default immediately outside isDevMode() (no query-param read, no
sessionStorage write), and the three adapters additionally wrap their
headers in isDevMode() so a production request carries neither header
at all, matching what an HttpClient request already does once the
interceptors aren't registered.

TE-002: reveal-bignummer's response-shape validation was a "Trust
boundary" a spec could only reach by stubbing globalThis.fetch.
Exported it as parseRevealed(body), matching the other 30 parse*
boundaries in the repo. Same treatment for letter-preview's
errorMessage and org-template's proefbrief error mapping (extracted
from an inline try/catch into a named, exported function first, since
it wasn't already separate).

BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally,
so the backend's step-up precondition constrained nothing. reveal()
now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable
only after the UI's confirm() gesture -- is the one that supplies it,
so the literal no longer lives in the transport adapter.

BIO-006(b): documented in roles-and-access.md that drafter is also
the backend's fallback identity (StubIdentityProvider's catch-all
arm), not just the dev switcher's initial choice -- so the
least-privilege consequence of it also being the only role that may
reveal a BSN is visible.

Doc correction, same diff: roles-and-access.md's "wired only under
isDevMode()" claim was false for the three hand-written fetch paths;
it now says where the gate lives (interceptor registration and the
reader functions) so it doesn't go stale the same way again.
CLAUDE.md's dev-only claims needed no correction -- they already
noted these three calls bypass the interceptor.

Every fix has a test confirmed red by temporarily reverting the
source change and rerunning the suite before restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/ssp/src/app/brief/infrastructure/org-template.adapter.ts

@@ -1,4 +1,4 @@
-import { Injectable, inject } from '@angular/core';
+import { Injectable, inject, isDevMode } from '@angular/core';
 import { Result, ok, err } from '@shared/kernel/fp';
 import { runSubmit } from '@shared/application/submit';
 import { currentRole } from '@shared/infrastructure/role';
@@ -26,10 +26,13 @@ import { parseOrgTemplate } from '@brief/infrastructure/brief.adapter';
  * rollback go through the generated client (X-Role added by `roleInterceptor`);
  * `parse*` narrows the untrusted wire shape. The proefbrief is `text/html` and
  * `ExcludeFromDescription`'d — a hand-written fetch, same seam as `letter-preview.adapter`.
+ * `X-Role` there is a dev-only identity stand-in (`role.ts`) and is sent only under
+ * `isDevMode()`, mirroring `roleInterceptor`'s own dev-only registration — a production
+ * build never sends it from this hand-written call either (BIO-012).
  */
 
 const FAILED = $localize`:@@orgTemplate.action.failed:De actie is niet gelukt. Probeer het later opnieuw.`;
-const PROEFBRIEF_FAILED = $localize`:@@orgTemplate.proefbrief.failed:De proefbrief kon niet worden geopend.`;
+export const PROEFBRIEF_FAILED = $localize`:@@orgTemplate.proefbrief.failed:De proefbrief kon niet worden geopend.`;
 
 @Injectable({ providedIn: 'root' })
 export class OrgTemplateAdapter {
@@ -76,22 +79,26 @@ export class OrgTemplateAdapter {
     try {
       res = await fetch(
         `${environment.apiBaseUrl}/api/v1/admin/org-template/${encodeURIComponent(subOrgId)}/preview`,
-        { headers: { 'X-Role': currentRole() } },
+        { headers: isDevMode() ? { 'X-Role': currentRole() } : {} },
       );
     } catch {
       return err(PROEFBRIEF_FAILED);
     }
-    if (!res.ok) {
-      try {
-        return err(problemDetail(await res.json(), PROEFBRIEF_FAILED));
-      } catch {
-        return err(PROEFBRIEF_FAILED);
-      }
-    }
+    if (!res.ok) return err(await proefbriefErrorMessage(res));
     return ok(await res.blob());
   }
 }
 
+/** Trust boundary (TE-002): maps a non-OK proefbrief response to a message. Exported
+    so a spec can call it directly instead of stubbing `globalThis.fetch`. */
+export async function proefbriefErrorMessage(res: Response): Promise<string> {
+  try {
+    return problemDetail(await res.json(), PROEFBRIEF_FAILED);
+  } catch {
+    return PROEFBRIEF_FAILED;
+  }
+}
+
 // --- parse: wire → domain, validating at the boundary ---
 
 function parseSubOrg(dto: SubOrgSummaryDto): Result<string, SubOrgSummary> {