Serve a blob inline for the FilePreview viewer.

Sibling of download with the same authorization model but two extra guarantees:

• the response Content-Type is the MIME type detected from the bytes (via python-magic), not the value declared at upload time;
• the detected MIME must belong to PREVIEWABLE_MIME_TYPES, otherwise the endpoint refuses with 415.

Returning 415 (rather than 200 with the raw payload) is the security contract that lets the frontend render the response inline: any byte we send back has been re-classified server-side as one of the safe previewable types.