refactor(shared): add BLOB_PRESENTER, unlock the blob-to-browser success paths (RB-28)

Three application-layer commands ended in raw DOM calls (URL.createObjectURL,
window.open, document.createElement('a').click(), URL.revokeObjectURL) as
their last statement. jsdom cannot assert a call that is also the end of the
function, so each command's success path stayed unassertable, and
StamdataStore.download()'s two-clause guard stayed permanently dark on its
true branch (TE-006).

Add BLOB_PRESENTER (libs/shared/src/application/blob-presenter.ts), an
InjectionToken mirroring SESSION_PORT's shape: an interface with open()/
download(), a real implementation preserving the existing open()-never-
revokes vs download()-always-revokes asymmetry, provided in root. Route
StamdataStore.download(), BriefStore.previewLetter(), and
OrgTemplateStore.proefbrief() through it.

Add specs with a recording fake presenter: StamdataStore.download()'s guard
(both clauses) and its success path, asserting toJson(...)'s exact output
reaches the file; BriefStore.previewLetter()'s existing success test now
goes through the seam instead of spying on window/URL directly; a new
org-template.store.spec.ts (none existed before) covers proefbrief()'s
success and failure paths.

Verified red without the fix by editing the download() filename to the
wrong extension, watching the success-path spec fail, then restoring it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

libs/shared/docs/behaviour-spec.mdx

@@ -20,7 +20,7 @@ tested where._
 
 Every bullet below is a real test name from the suite — an `it()` title (frontend) or a test
 method name (backend), read as a sentence. Nothing here is hand-written prose: this page
-**is** the suite, reshaped for a business reader. 467 frontend behaviours across
+**is** the suite, reshaped for a business reader. 472 frontend behaviours across
 9 contexts; 261 backend behaviours across 42 test
 classes.
 
@@ -114,6 +114,12 @@ classes.
 - records addRow and undoes it
 - clears history when switching table
 
+#### StamdataStore.download (RB-28)
+
+- does not call the presenter while the two-clause guard blocks (nothing dirty yet)
+- does not call the presenter while previewing a date, even with edits
+- passes toJson(...)'s exact output and the table id as the filename (success path)
+
 #### activeOn (valid-time, half-open [van, tot))
 
 - includes a row whose window covers the date
@@ -187,7 +193,7 @@ classes.
 
 #### BriefStore.previewLetter
 
-- opens the composed letter in a new tab on success
+- opens the composed letter via BLOB_PRESENTER on success (RB-28)
 - surfaces the error without opening a tab on failure
 
 #### BriefStore.revealBigNummer (PRD-0002 §5c)
@@ -200,6 +206,11 @@ classes.
 - sends no X-Role/X-Subject headers outside isDevMode()
 - sends X-Role (and X-Subject when known) under isDevMode()
 
+#### OrgTemplateStore.proefbrief (RB-28)
+
+- opens the rendered proefbrief via BLOB_PRESENTER on success
+- surfaces the error without opening a tab on failure
+
 #### RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)
 
 - sends X-Step-Up only when the caller passes stepUp: true