Get an allowed edit or single-use preview URL for a business preparation step

Permission: card.holder.preparation. Body: type=holder, id=steps[].id, action=edit or preview. Request only when opening the page. Returns {url}. Edit requires current business permission; preview requires canPreview and consumes the link on first full read. H5 performs its own submission: do not also call API submit. Next: poll GET /cards/preparation. This endpoint is also the preview entry point for identity mismatch.