Require site admin to preview files on disk

`sync_preview` had no permission check, allowing any logged-in user to retrieve full listings of staged files with paths, sizes, and MIME types.