` * for every row on every listing render, not a deliberate action, and * logging it would flood the activity log with non-events. `preview()` * logs Action::FilePreviewed, since a user explicitly chose to view the * file's contents — a real, audit-worthy action, just not a "download." * * SECURITY: both methods serve bytes inline, from this app's own origin, * with the File's stored mime type, so both are restricted to an * allowlist — but not the same one, because they are asking different * questions. `thumbnail()` is bounded by * ThumbnailGenerator::SUPPORTED_MIME_TYPES, the raster formats this app * decodes and re-encodes itself, since a thumbnail *is* a rendition. * `preview()` is bounded by PreviewKind, which additionally admits the * video, audio and PDF types a browser plays natively and this app never * touches. PreviewKind's docblock carries the rule in full; the short * version is that neither list may ever grow a type a browser executes * script from, and neither may be derived from the upload * allowed-extensions setting, which matches on the *extension* while * mime_type is detected from the *bytes* * (ChunkedUploadsController::complete). * * Serving media inline is also why `preview()` logs at most one * Action::FilePreviewed per viewer per file per five minutes: a `