feat(coding): add preview data runtime session

electron/api/server.ts

@@ -6,6 +6,7 @@ import type { HostApiContext } from './context';
 import { sendJson, setCorsHeaders, requireJsonContentType } from './route-utils';
 import { rotateRendererCapability } from './renderer-capability';
 import { hostApiRouteHandlers } from './route-handlers';
+import { handlePreviewDataRoutes, isPreviewDataRoute } from './routes/runtime-data';
 
 /**
  * Per-session secret token used to authenticate Host API requests.
@@ -29,6 +30,16 @@ export function startHostApiServer(ctx: HostApiContext, port = getPort('NIANCODE
   const server = createServer(async (req, res) => {
     try {
       const requestUrl = new URL(req.url || '/', `http://127.0.0.1:${port}`);
+
+      // Preview data is a separate, capability-scoped data plane. It must not
+      // pass through the broad Host token, Renderer CORS, preflight, or JSON
+      // gates below: preview pages only have their exact Origin and ephemeral
+      // data bearer. Keep this branch out of the shared in-process dispatcher.
+      if (isPreviewDataRoute(requestUrl.pathname)) {
+        await handlePreviewDataRoutes(req, res, requestUrl, ctx);
+        return;
+      }
+
       // ── CORS headers ─────────────────────────────────────────
       // Set origin-aware CORS headers early so every response
       // (including error responses) carries them consistently.