Merge RB-11 — keep the dev hatches out of production builds

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -20,7 +20,7 @@ tested where._
 
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
-**is** the suite, reshaped for a business reader. 415 frontend behaviours across
+**is** the suite, reshaped for a business reader. 440 frontend behaviours across
 9 contexts; 228 backend behaviours across 38 test
 classes.
 
@@ -181,6 +181,16 @@ classes.
 - swaps the masked value for the revealed one on success
 - keeps the value masked and surfaces the error on failure
 
+#### LetterPreviewAdapter.preview (BIO-012)
+
+- sends no X-Role/X-Subject headers outside isDevMode()
+- sends X-Role (and X-Subject when known) under isDevMode()
+
+#### RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)
+
+- sends X-Step-Up only when the caller passes stepUp: true
+- sends X-Role only under isDevMode()
+
 #### besluitGuidance
 
 - positief: counts inserted passages, no reden needed (positief has no redenen)
@@ -232,6 +242,12 @@ classes.
 - marks added, removed, changed and unchanged by blockId
 - changedBlocks drops unchanged and keeps added/removed/changed
 
+#### errorMessage (TE-002 trust boundary)
+
+- surfaces the ProblemDetails detail when present
+- falls back to PREVIEW_FAILED when the body has no detail
+- falls back to PREVIEW_FAILED when the body is not JSON
+
 #### inferSelection
 
 - round-trips a positief selection
@@ -270,6 +286,13 @@ classes.
 - rejects a missing count field
 - rejects a malformed history entry
 
+#### parseRevealed (TE-002 trust boundary)
+
+- accepts a well-formed body
+- rejects a bigNummer sent as a number
+- rejects a missing bigNummer field
+- rejects null and non-object bodies
+
 #### passagesForBesluit
 
 - positief = shared intro + the positief passage, no negatief/reason passages
@@ -278,6 +301,12 @@ classes.
 - preserves library order (= reading order)
 - never offers non-kern passages
 
+#### proefbriefErrorMessage (TE-002 trust boundary)
+
+- surfaces the ProblemDetails detail when present
+- falls back to PROEFBRIEF_FAILED when the body has no detail
+- falls back to PROEFBRIEF_FAILED when the body is not JSON
+
 #### redenenFor
 
 - derives reason checkboxes (code + label) from the negatief reason passages
@@ -642,6 +671,29 @@ classes.
 - applies the pure update on dispatch
 - dispatch from inside an effect does not self-loop
 
+#### currentRole (dev mechanism)
+
+- lists the three roles
+- reads a valid ?role= from the URL and persists it for the tab
+- falls back to drafter when nothing is set or the value is invalid
+
+#### currentRole (dev mechanism) › outside isDevMode() (production build)
+
+- ignores a ?role= in the URL and returns the default
+- never touches sessionStorage
+- ignores a role already sitting in sessionStorage from a prior dev session
+
+#### currentSubject (dev mechanism)
+
+- reads a ?subject= from the URL and persists it for the tab
+- returns undefined when nothing has ever been set
+
+#### currentSubject (dev mechanism) › outside isDevMode() (production build)
+
+- ignores a ?subject= (a BSN) in the URL and returns undefined
+- never writes the BSN into sessionStorage
+- ignores a subject already sitting in sessionStorage from a prior dev session
+
 #### delete flow (optimistic, revertible)
 
 - UploadDeleteRequested keeps the documentId for revert