Preview deployments share the production Blob store, so media edits in a preview change the live site

## Problem

The Neon integration gives every preview deployment its own database branch, so content edits in a preview are isolated. **Media is not isolated.** Vercel Blob is a single project-level store reached through one `BLOB_READ_WRITE_TOKEN`, so every preview shares the production media library.

The practical consequence: someone evaluating the CMS in a preview deployment can open the Media collection and delete an image, and that image disappears from the production demo that everyone else sees. Uploads land in the shared store too, so previews accumulate files that production then serves.

This makes a preview unsafe to hand to anyone who might reasonably click "delete" while trying the CMS out, which is the main thing previews are useful for.

## Why it happens

- database: branched per preview by the Neon integration, isolated
- Blob: one store per Vercel project, one token, shared by every deployment including previews

Isolation is currently tested per platform rather than per store, so a database-isolation check passes while media remains shared.

## Possible fixes

1. **A separate Blob store per preview**, with a branch-scoped `BLOB_READ_WRITE_TOKEN`. Cleanest isolation, but needs a store provisioned per preview and torn down with it
2. **A per-preview path prefix enforced in the upload adapter**, with reads filtered to the same prefix. Cheaper, no extra provisioning, but it is isolation by convention, and a bug in the filter leaks across previews
3. **Read-only media in previews**, disabling upload and delete when a preview environment is detected. Smallest change, but it removes a capability that is worth demonstrating

Option 1 is the only one that makes a preview genuinely safe to hand over. Option 2 is a reasonable interim if provisioning per preview is too costly.

## Acceptance criteria

- deleting or uploading a media item in a preview deployment has no effect on production or on any other preview
- an isolation check covers the media store specifically, not only the database
- teardown of a preview also releases whatever media storage it allocated

Start by tracing the Neon preview branching and Vercel Blob token and upload-adapter paths described in the issue. Compare the isolation options, then verify that the chosen approach covers media-specific isolation checks and releases preview storage during teardown.

Written by the indexing model from the issue text.