Merge RB-08 + RB-09 — CasesAdmin on the admin upload delete; no-identity representable

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

libs/shared/docs/behaviour-spec.mdx

@@ -21,7 +21,7 @@ tested where._
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
 **is** the suite, reshaped for a business reader. 440 frontend behaviours across
-9 contexts; 228 backend behaviours across 38 test
+9 contexts; 231 backend behaviours across 39 test
 classes.
 
 ## Frontend (by context)
@@ -899,6 +899,7 @@ classes.
 - A denied admin action is recorded
 - A reveal attempt is recorded
 - An allowed admin action is recorded
+- An admin upload delete is recorded
 - A feature flag toggle records which flag changed
 - A refused brief transition is recorded
 - No audit row carries a subjects bsn
@@ -1124,6 +1125,10 @@ classes.
 - Proefbrief is admin only
 - Proefbrief renders the draft template with a watermark
 
+### ProductionIdentityProviderTests
+
+- Production environment with no real identity provider fails at startup
+
 ### ProfessionsTests
 
 - A mapping is absent before its geldigVan
@@ -1159,6 +1164,7 @@ classes.
 - Empty x medewerker falls through to the zorgverlener default
 - X rollen parses known tokens and drops unknown ones
 - X role still applies to a medewerker
+- Never returns null even with no headers at all
 
 ### SubmissionRuleTests
 

libs/shared/src/infrastructure/api-client.ts

@@ -612,7 +612,9 @@ export class ApiClient {
             });
         } else if (status === 403) {
             return response.text().then((_responseText) => {
-            return throwException("Forbidden", status, _responseText, _headers);
+            let result403: any = null;
+            result403 = _responseText === "" ? null : JSON.parse(_responseText, this.jsonParseReviver) as ProblemDetails;
+            return throwException("Forbidden", status, _responseText, _headers, result403);
             });
         } else if (status === 404) {
             return response.text().then((_responseText) => {