fix(brief): keep the dev hatches out of production builds (RB-11)

BIO-012: roleInterceptor/subjectInterceptor are correctly registered
only under isDevMode(), but three hand-written fetch adapters
(reveal-bignummer, letter-preview, org-template's proefbrief) bypass
HttpClient and set X-Role/X-Subject themselves with no guard. The
readers underneath, role.ts and subject.ts, were ungated too: they
read ?role=/?subject= and wrote it into sessionStorage on any
navigation, in any build -- for ?subject= that value is a BSN, which
is exactly what SessionStore's G1 comment promises never happens.

Gate both layers: currentRole()/currentSubject() return their safe
default immediately outside isDevMode() (no query-param read, no
sessionStorage write), and the three adapters additionally wrap their
headers in isDevMode() so a production request carries neither header
at all, matching what an HttpClient request already does once the
interceptors aren't registered.

TE-002: reveal-bignummer's response-shape validation was a "Trust
boundary" a spec could only reach by stubbing globalThis.fetch.
Exported it as parseRevealed(body), matching the other 30 parse*
boundaries in the repo. Same treatment for letter-preview's
errorMessage and org-template's proefbrief error mapping (extracted
from an inline try/catch into a named, exported function first, since
it wasn't already separate).

BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally,
so the backend's step-up precondition constrained nothing. reveal()
now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable
only after the UI's confirm() gesture -- is the one that supplies it,
so the literal no longer lives in the transport adapter.

BIO-006(b): documented in roles-and-access.md that drafter is also
the backend's fallback identity (StubIdentityProvider's catch-all
arm), not just the dev switcher's initial choice -- so the
least-privilege consequence of it also being the only role that may
reveal a BSN is visible.

Doc correction, same diff: roles-and-access.md's "wired only under
isDevMode()" claim was false for the three hand-written fetch paths;
it now says where the gate lives (interceptor registration and the
reader functions) so it doesn't go stale the same way again.
CLAUDE.md's dev-only claims needed no correction -- they already
noted these three calls bypass the interceptor.

Every fix has a test confirmed red by temporarily reverting the
source change and rerunning the suite before restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/ssp/src/app/brief/infrastructure/org-template.adapter.spec.ts

@@ -1,6 +1,10 @@
 import { describe, it, expect } from 'vitest';
 import { OrgTemplateAdminViewDto, OrgTemplateDto } from '@shared/infrastructure/api-client';
-import { parseOrgTemplateAdminView } from './org-template.adapter';
+import {
+  parseOrgTemplateAdminView,
+  proefbriefErrorMessage,
+  PROEFBRIEF_FAILED,
+} from './org-template.adapter';
 
 const draft: OrgTemplateDto = {
   subOrgId: 'cibg-registers',
@@ -54,3 +58,25 @@ describe('parseOrgTemplateAdminView', () => {
     expect(r.ok).toBe(false);
   });
 });
+
+// Minimal Response stand-in — proefbriefErrorMessage only calls `.json()`. Avoids
+// stubbing globalThis.fetch to reach this trust boundary (TE-002).
+const fakeResponse = (body: unknown): Response =>
+  ({ json: () => Promise.resolve(body) }) as unknown as Response;
+
+describe('proefbriefErrorMessage (TE-002 trust boundary)', () => {
+  it('surfaces the ProblemDetails detail when present', async () => {
+    expect(
+      await proefbriefErrorMessage(fakeResponse({ detail: 'Niet gevonden.', status: 404 })),
+    ).toBe('Niet gevonden.');
+  });
+
+  it('falls back to PROEFBRIEF_FAILED when the body has no detail', async () => {
+    expect(await proefbriefErrorMessage(fakeResponse({ status: 500 }))).toBe(PROEFBRIEF_FAILED);
+  });
+
+  it('falls back to PROEFBRIEF_FAILED when the body is not JSON', async () => {
+    const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
+    expect(await proefbriefErrorMessage(res)).toBe(PROEFBRIEF_FAILED);
+  });
+});