docs: regenerate behaviour spec (RB-07 drift, RB-08, RB-09)

`npm run gen:behaviour-spec`'s drift check (part of `npm run ci`)
caught two things: RB-07 had already left this generated doc stale
(three of its new AuthzAuditTests cases were never picked up), and
RB-08/RB-09 added more test names since. Regenerated so the doc
matches the suite it claims to mirror.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/shared/docs/behaviour-spec.mdx

@@ -21,7 +21,7 @@ tested where._
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
 **is** the suite, reshaped for a business reader. 402 frontend behaviours across
-8 contexts; 225 backend behaviours across 38 test
+8 contexts; 231 backend behaviours across 39 test
 classes.
 
 ## Frontend (by context)
@@ -825,6 +825,10 @@ classes.
 
 - A denied admin action is recorded
 - A reveal attempt is recorded
+- An allowed admin action is recorded
+- An admin upload delete is recorded
+- A feature flag toggle records which flag changed
+- A refused brief transition is recorded
 - No audit row carries a subjects bsn
 - The audit schema carries no pii
 
@@ -1048,6 +1052,10 @@ classes.
 - Proefbrief is admin only
 - Proefbrief renders the draft template with a watermark
 
+### ProductionIdentityProviderTests
+
+- Production environment with no real identity provider fails at startup
+
 ### ProfessionsTests
 
 - A mapping is absent before its geldigVan
@@ -1083,6 +1091,7 @@ classes.
 - Empty x medewerker falls through to the zorgverlener default
 - X rollen parses known tokens and drops unknown ones
 - X role still applies to a medewerker
+- Never returns null even with no headers at all
 
 ### SubmissionRuleTests