Preview mode for destructive actions

Call any writable endpoint with `preview: true` in the request body to see what would happen without executing.

The response includes an impact assessment and a signed confirmation token. Submit the token within 5 minutes to execute the previewed action. Expired or tampered tokens are rejected.