refactor(shared): add BLOB_PRESENTER, unlock the blob-to-browser success paths (RB-28)

Three application-layer commands ended in raw DOM calls (URL.createObjectURL,
window.open, document.createElement('a').click(), URL.revokeObjectURL) as
their last statement. jsdom cannot assert a call that is also the end of the
function, so each command's success path stayed unassertable, and
StamdataStore.download()'s two-clause guard stayed permanently dark on its
true branch (TE-006).

Add BLOB_PRESENTER (libs/shared/src/application/blob-presenter.ts), an
InjectionToken mirroring SESSION_PORT's shape: an interface with open()/
download(), a real implementation preserving the existing open()-never-
revokes vs download()-always-revokes asymmetry, provided in root. Route
StamdataStore.download(), BriefStore.previewLetter(), and
OrgTemplateStore.proefbrief() through it.

Add specs with a recording fake presenter: StamdataStore.download()'s guard
(both clauses) and its success path, asserting toJson(...)'s exact output
reaches the file; BriefStore.previewLetter()'s existing success test now
goes through the seam instead of spying on window/URL directly; a new
org-template.store.spec.ts (none existed before) covers proefbrief()'s
success and failure paths.

Verified red without the fix by editing the download() filename to the
wrong extension, watching the success-path spec fail, then restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/shared/src/application/blob-presenter.ts

@@ -0,0 +1,37 @@
+import { InjectionToken } from '@angular/core';
+
+/**
+ * A shared seam for handing a generated `Blob` to the browser, WITHOUT the calling
+ * command inlining `URL.createObjectURL`/`window.open`/`document.createElement('a')`
+ * as its own last statement (TE-006) — those calls are unassertable in jsdom because
+ * they are the end of the command, not a value the spec can intercept. A recording
+ * fake satisfies this shape in specs; `realBlobPresenter` is the production default.
+ */
+export interface BlobPresenter {
+  /** Open a blob in a new tab (e.g. a rendered letter preview). Never revokes the
+      object URL — the tab outlives this call, and the POC treats the leak as cheap
+      (see `BriefStore.previewLetter`'s original comment). */
+  open(blob: Blob): void;
+  /** Trigger a browser download of a blob under the given file name, then revoke the
+      object URL once the click has been dispatched. */
+  download(blob: Blob, filename: string): void;
+}
+
+const realBlobPresenter: BlobPresenter = {
+  open(blob: Blob) {
+    window.open(URL.createObjectURL(blob), '_blank');
+  },
+  download(blob: Blob, filename: string) {
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = filename;
+    a.click();
+    URL.revokeObjectURL(url);
+  },
+};
+
+export const BLOB_PRESENTER = new InjectionToken<BlobPresenter>('BLOB_PRESENTER', {
+  providedIn: 'root',
+  factory: () => realBlobPresenter,
+});