test(auth): extract and spec the stored-session parse boundary (RB-10)

SessionStore.restore() — identical in both apps — read localStorage itself
and did the parse plus shape validation in the same module-private function,
invoked from a field initializer, so the storage read happened the instant
the singleton was constructed and no spec could feed it a raw string. The
logic it guards is a trust boundary, not incidental validation: the comment
above it names G1 (never persist the BSN) and G2 (validate the shape before
trusting it), and CLAUDE.md mandates a spec for boundary parse* adapters.
ssp/auth and bhp/auth were jointly the worst-covered frontend modules.

parseStoredSession(raw) moves into each app's auth/domain/session.ts, which
is pure TS and already had a spec, so no new scaffolding was needed;
restore() collapses to one line. Four cases: absent, non-JSON, wrong shape,
and — BIO-017's addition — a stored {"bsn":…,"naam":…} restoring with bsn
'', which makes the G1 guarantee executable rather than merely commented.
Verified red without the fix.

Landed twice, once per app, deliberately. TE-001 and BL-002 both say an
extract-to-shared here would contradict ADR-0002, which models the two
actors as different Principal variants and expects the two auth contexts to
diverge; RB-13 is what differentiates them.

Also specs redactProfile (BIO-017's second half) — a pure exported
PII-redaction function that had none.

behaviour-spec.mdx is regenerated, which also picks up the test names RB-07
added; that commit should have carried them and did not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/ssp/src/app/auth/domain/session.spec.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { isAuthenticated, Session } from './session';
+import { isAuthenticated, parseStoredSession, Session } from './session';
 
 const session: Session = { bsn: '19012345601', naam: 'Test' };
 
@@ -12,3 +12,22 @@ describe('isAuthenticated', () => {
     expect(isAuthenticated(null)).toBe(false);
   });
 });
+
+describe('parseStoredSession', () => {
+  it('returns null when nothing is stored', () => {
+    expect(parseStoredSession(null)).toBeNull();
+  });
+
+  it('returns null for a non-JSON string', () => {
+    expect(parseStoredSession('not json')).toBeNull();
+  });
+
+  it('returns null when the stored shape is wrong (no naam)', () => {
+    expect(parseStoredSession(JSON.stringify({ bsn: '19012345601' }))).toBeNull();
+  });
+
+  it('G1: a stored bsn is never restored, even if present in the raw value', () => {
+    const restored = parseStoredSession(JSON.stringify({ bsn: '19012345601', naam: 'Test' }));
+    expect(restored).toEqual({ bsn: '', naam: 'Test' });
+  });
+});