feat(brief): WP-28 demo script, e2e spec, and story gap-fill

Closes phase 6 (Brief v2): a demo script mapping shipped scenarios to
URL+click paths (no Brief v2 PRD ever existed to translate one from —
written directly against the code instead), one e2e spec covering
compose→approve→send and admin republish→drafter-sees-it, and
Storybook state gaps (rejection diff, read-only viewer, org logo,
upload rejection) that prior WPs left uncovered. Flags passage-picker
as dead code, superseded by besluit-panel.

npm run e2e is not verified green in this sandbox — see WP-28's
Deviations section; the pre-existing, unmodified smoke.spec.ts fails
identically here, pointing at a sandbox rendering issue rather than a
regression.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -199,9 +199,14 @@ atomic layer it is (a context organism doesn't get its own `Organisms/` bucket).
   **token bridge** mapping the app's `--rhc-*` token vocabulary onto CIBG/`--bs-*` values (so
   components keep referencing tokens). System-font stack (licensed RO/Rijks fonts not shipped). See ADR-0003.
 - Scenario toggle (**dev-only**, not wired in prod builds): `?scenario=slow|loading|empty|error`
-  on data pages (`scenario.interceptor.ts`) to see every async state.
+  on data pages (`scenario.interceptor.ts`) to see every async state — sticky per tab
+  (change it via a full navigation, not an in-app link). Hand-written `fetch`/XHR calls
+  (uploads, `/brief/preview`, `/admin/org-template/*/preview`, `/brief/reveal-bignummer`)
+  bypass the interceptor.
 - Dev role stand-in (**dev-only**): `?role=drafter|approver|admin` (or the `⚙ state` dev panel).
-  Roles, how to switch, and what each unlocks: `docs/reference/roles-and-access.md`.
+  Roles, how to switch, and what each unlocks: `docs/reference/roles-and-access.md`. `admin`
+  unlocks the capability-gated pages: `/brief/huisstijl` (org-template editor),
+  `/beheer/stamdata`, `/beheer/zaken`, `/beheer/audit`, `/beheer/functies`.
 - Prettier; `.editorconfig`. tsconfig: `noImplicitReturns`,
   `noPropertyAccessFromIndexSignature`, `noFallthroughCasesInSwitch`, `isolatedModules`.
 - **Enforced, not just hoped-for:** `npm run lint` (`eslint.config.mjs`) fails the build