fix(beheer): send X-Role to /api/v1/stamdata (admin reads were 403)

The stamdata admin editor's adapter calls /api/v1/stamdata via the generated
ApiClient → roleInterceptor, but ROLE_AWARE omitted /api/v1/stamdata, so no X-Role
was sent and the backend StamdataAdmin gate resolved Drafter → 403 on every read
(confirmed: 403 without X-Role, 200 with X-Role: admin). Added /api/v1/stamdata to
the allow-list (same class of gap WP-23 fixed for /me) + a roleInterceptor spec so
the next admin endpoint isn't forgotten.

Note: a separate issue still blocks the page in the browser — capabilityGuard
redirects both admin routes to /login because it checks can() before /me resolves;
tracked separately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/shared/infrastructure/role.interceptor.ts

@@ -4,11 +4,17 @@ import { currentRole } from './role';
 /**
  * Dev-only: stamps role-aware requests with the current `?role=` as an `X-Role`
  * header so the backend can enforce the drafter/approver/admin rules. Only the
- * brief, org-template and /me endpoints carry it (WP-23 widened the set — /me must
- * see the role or `AccessStore` could never learn a capability); everything else
- * is untouched.
+ * brief, org-template, stamdata and /me endpoints carry it (WP-23 widened the set —
+ * /me must see the role or `AccessStore` could never learn a capability; WP-29 added
+ * /stamdata, whose admin-only reads 403 without it); everything else is untouched.
+ * A new admin-gated endpoint MUST be added here or its page silently 403s.
  */
-const ROLE_AWARE = ['/api/v1/brief', '/api/v1/admin/org-template', '/api/v1/me'];
+const ROLE_AWARE = [
+  '/api/v1/brief',
+  '/api/v1/admin/org-template',
+  '/api/v1/stamdata',
+  '/api/v1/me',
+];
 
 export const roleInterceptor: HttpInterceptorFn = (req, next) => {
   if (!ROLE_AWARE.some((prefix) => req.url.includes(prefix))) return next(req);