def safe_preview(url: str):
    if not url:
        return "<i>No preview available</i>"
    blocked = ["pdf", "download"]
    if any(b in url.lower() for b in blocked):
        return "<i>Preview disabled (redaction-protected document)</i>"
    return f"<iframe src='{url}' width='100%' height='400'></iframe>"