refactor(shared): add BLOB_PRESENTER, unlock the blob-to-browser success paths (RB-28)

Three application-layer commands ended in raw DOM calls (URL.createObjectURL,
window.open, document.createElement('a').click(), URL.revokeObjectURL) as
their last statement. jsdom cannot assert a call that is also the end of the
function, so each command's success path stayed unassertable, and
StamdataStore.download()'s two-clause guard stayed permanently dark on its
true branch (TE-006).

Add BLOB_PRESENTER (libs/shared/src/application/blob-presenter.ts), an
InjectionToken mirroring SESSION_PORT's shape: an interface with open()/
download(), a real implementation preserving the existing open()-never-
revokes vs download()-always-revokes asymmetry, provided in root. Route
StamdataStore.download(), BriefStore.previewLetter(), and
OrgTemplateStore.proefbrief() through it.

Add specs with a recording fake presenter: StamdataStore.download()'s guard
(both clauses) and its success path, asserting toJson(...)'s exact output
reaches the file; BriefStore.previewLetter()'s existing success test now
goes through the seam instead of spying on window/URL directly; a new
org-template.store.spec.ts (none existed before) covers proefbrief()'s
success and failure paths.

Verified red without the fix by editing the download() filename to the
wrong extension, watching the success-path spec fail, then restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/ssp/src/app/brief/application/brief.store.ts

@@ -21,6 +21,7 @@ import { LetterPreviewAdapter } from '@brief/infrastructure/letter-preview.adapt
 import { RevealBigNummerAdapter } from '@brief/infrastructure/reveal-bignummer.adapter';
 import { uploadContentUrl } from '@shared/infrastructure/upload.adapter';
 import { PendingSave, registerPendingSave } from '@shared/application/pending-saves';
+import { BLOB_PRESENTER } from '@shared/application/blob-presenter';
 
 /**
  * Root singleton for the letter: the Elm store (Model + dispatch), the derived
@@ -35,6 +36,7 @@ export class BriefStore implements PendingSave {
   private adapter = inject(BriefAdapter);
   private previewAdapter = inject(LetterPreviewAdapter);
   private revealAdapter = inject(RevealBigNummerAdapter);
+  private blobPresenter = inject(BLOB_PRESENTER);
   private store = createStore<BriefState, BriefMsg>(initial, reduce);
 
   readonly model = this.store.model;
@@ -244,8 +246,8 @@ export class BriefStore implements PendingSave {
   send = () => this.transition(() => this.adapter.send());
 
   /** Explicit action, never a live re-render (PRD §8): opens the server-composed
-      letter in a new tab. ponytail: the blob URL is never revoked — it's cheap and
-      the tab outlives this call; not worth a teardown hook for a POC. */
+      letter in a new tab via `BLOB_PRESENTER.open` — see its doc comment for why the
+      object URL is never revoked. */
   async previewLetter() {
     this.actionState.set({ tag: 'Busy' });
     const r = await this.previewAdapter.preview();
@@ -254,7 +256,7 @@ export class BriefStore implements PendingSave {
       return;
     }
     this.actionState.set({ tag: 'Idle' });
-    window.open(URL.createObjectURL(r.value), '_blank');
+    this.blobPresenter.open(r.value);
   }
 
   /** Reveal the masked case BIG-nummer (PRD-0002 §5c). Server re-checks the capability