refactor(shared): add BLOB_PRESENTER, unlock the blob-to-browser success paths (RB-28)

Three application-layer commands ended in raw DOM calls (URL.createObjectURL,
window.open, document.createElement('a').click(), URL.revokeObjectURL) as
their last statement. jsdom cannot assert a call that is also the end of the
function, so each command's success path stayed unassertable, and
StamdataStore.download()'s two-clause guard stayed permanently dark on its
true branch (TE-006).

Add BLOB_PRESENTER (libs/shared/src/application/blob-presenter.ts), an
InjectionToken mirroring SESSION_PORT's shape: an interface with open()/
download(), a real implementation preserving the existing open()-never-
revokes vs download()-always-revokes asymmetry, provided in root. Route
StamdataStore.download(), BriefStore.previewLetter(), and
OrgTemplateStore.proefbrief() through it.

Add specs with a recording fake presenter: StamdataStore.download()'s guard
(both clauses) and its success path, asserting toJson(...)'s exact output
reaches the file; BriefStore.previewLetter()'s existing success test now
goes through the seam instead of spying on window/URL directly; a new
org-template.store.spec.ts (none existed before) covers proefbrief()'s
success and failure paths.

Verified red without the fix by editing the download() filename to the
wrong extension, watching the success-path spec fail, then restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/beheer/src/application/stamdata.store.spec.ts

@@ -1,7 +1,8 @@
 import { TestBed } from '@angular/core/testing';
 import { describe, it, expect } from 'vitest';
 import { Result, ok } from '@shared/kernel/fp';
-import { StamRow, StamTable } from '@beheer/domain/stamdata';
+import { BLOB_PRESENTER, BlobPresenter } from '@shared/application/blob-presenter';
+import { StamRow, StamTable, toJson } from '@beheer/domain/stamdata';
 import { StamdataAdapter } from '@beheer/infrastructure/stamdata.adapter';
 import { StamdataStore } from './stamdata.store';
 
@@ -16,13 +17,30 @@ const table: StamTable = {
 };
 const rows: StamRow[] = [{ program: 'geneeskunde', beroep: 'Arts' }];
 
-function setup(): StamdataStore {
+/** A recording fake of BLOB_PRESENTER — records every call instead of touching the DOM,
+    which is what TE-006's seam is for: the store's success path becomes assertable. */
+function fakeBlobPresenter() {
+  const opened: Blob[] = [];
+  const downloaded: { blob: Blob; filename: string }[] = [];
+  const presenter: BlobPresenter = {
+    open: (blob) => opened.push(blob),
+    download: (blob, filename) => downloaded.push({ blob, filename }),
+  };
+  return { presenter, opened, downloaded };
+}
+
+function setup(blobPresenter?: BlobPresenter): StamdataStore {
   const adapter: Partial<StamdataAdapter> = {
     list: (): Promise<Result<string, StamTable[]>> => Promise.resolve(ok([table])),
     load: (): Promise<Result<string, { table: StamTable; rows: StamRow[] }>> =>
       Promise.resolve(ok({ table, rows: rows.map((r) => ({ ...r })) })),
   };
-  TestBed.configureTestingModule({ providers: [{ provide: StamdataAdapter, useValue: adapter }] });
+  TestBed.configureTestingModule({
+    providers: [
+      { provide: StamdataAdapter, useValue: adapter },
+      ...(blobPresenter ? [{ provide: BLOB_PRESENTER, useValue: blobPresenter }] : []),
+    ],
+  });
   return TestBed.inject(StamdataStore);
 }
 
@@ -63,3 +81,57 @@ describe('StamdataStore undo/redo (WP-32)', () => {
     expect(store.canUndo()).toBe(false);
   });
 });
+
+// --- RB-28 (TE-006): download() ends in BLOB_PRESENTER.download, not raw DOM calls,
+// so the seam makes both the guard's branches and the success path assertable. ---
+
+describe('StamdataStore.download (RB-28)', () => {
+  it('does not call the presenter while the two-clause guard blocks (nothing dirty yet)', async () => {
+    // Given a freshly loaded table with no edits — canDownload() is false.
+    const { presenter, downloaded } = fakeBlobPresenter();
+    const store = setup(presenter);
+    await store.load();
+    expect(store.canDownload()).toBe(false);
+
+    // When download() is called...
+    store.download();
+
+    // Then the guard's true branch fires and the presenter is never reached.
+    expect(downloaded).toHaveLength(0);
+  });
+
+  it('does not call the presenter while previewing a date, even with edits', async () => {
+    // Given a loaded table with a real edit, but a preview date filter active.
+    const { presenter, downloaded } = fakeBlobPresenter();
+    const store = setup(presenter);
+    await store.load();
+    store.editCell(0, 'beroep', 'Chirurg');
+    store.setPreviewDate('2024-01-01');
+    expect(store.canDownload()).toBe(false);
+
+    // When download() is called...
+    store.download();
+
+    // Then the guard still blocks it.
+    expect(downloaded).toHaveLength(0);
+  });
+
+  it("passes toJson(...)'s exact output and the table id as the filename (success path)", async () => {
+    // Given a loaded table with a valid, dirty edit — canDownload() is true.
+    const { presenter, downloaded } = fakeBlobPresenter();
+    const store = setup(presenter);
+    await store.load();
+    store.editCell(0, 'beroep', 'Chirurg');
+    expect(store.canDownload()).toBe(true);
+    const expectedJson = toJson(store.table()!, store.rows());
+
+    // When download() is called...
+    store.download();
+
+    // Then the presenter receives exactly one call, with toJson's output reaching the
+    // file byte-for-byte and the table id as the file name.
+    expect(downloaded).toHaveLength(1);
+    expect(downloaded[0].filename).toBe('professions.json');
+    await expect(downloaded[0].blob.text()).resolves.toBe(expectedJson);
+  });
+});