Bound native media preview capabilities and source range reads

apps/desktop/src/media-access.ts

@@ -0,0 +1,9 @@
+/** Native previews carry an opaque grant, never a filesystem path or URL. */
+export function nativePreviewToken(value: string): string {
+  if (!/^[a-f0-9]{32}$/.test(value)) {
+    throw new Error(
+      "Media preview access is unavailable. Select the file again.",
+    );
+  }
+  return value;
+}