Streams a file for inline preview by short-lived download token.

Access: Anonymous requests are allowed, but the download token is still validated server-side.

Sets Content-Disposition: inline so browsers can render previewable formats in the current window.
The response also includes X-Content-Type-Options: nosniff for safer browser handling.

Preview URLs expire after 10 seconds. .docx files are converted to PDF before streaming; other
file types are returned with their stored content type and may still download if the browser cannot render them inline.