Share links: entry and page scopes, and one preview mechanism replacing POST /api/preview

Follows the site holding mode decision on #841 (14 September 2026). Site share links ship in 4.2.0 scoped to the whole site. Two things were left for later so they can share one token design with signed action links (#840).

## Change

- **Scopes.** A share link can also be scoped to one entry (including a draft) or one page path, so an editor sends a client one unpublished page to review without opening the whole holding site.
- **One preview mechanism.** `POST /api/preview` issues a 30-minute JWT for one draft entry that cannot be revoked and is not audited. Replace it with an entry-scoped share link (revocable, audited, labelled, expiring), keeping the old route working as a thin wrapper until 5.0.0 with a deprecation header.
- **Shared machinery with #840.** Issuing, hashing, redeeming, revoking and auditing tokens lives in one place in core auth, used by share links and by one-click action links.
- Draft reads through a link still pass the Public-field and Sensitivity gates, and the redeem exchange sets no-store and never puts the key in a URL the server logs.

## Done when

- An entry-scoped link previews that draft and nothing else, and stops working when revoked.
- `POST /api/preview` returns a link-backed token with a deprecation header, and existing callers keep working.

## Where it lives

Core: tokens that grant draft reads shape delivery and auth, where the preview token and #840 already live.

Start by tracing the core auth token machinery and the existing POST /api/preview route, then compare the shared-token requirements with action links in #840. Verify the entry and page scopes, draft-read gates, revocation and audit behavior, and the deprecation wrapper. Done means entry-scoped previews expose only the intended draft and existing preview callers still work.

Written by the indexing model from the issue text.