A signed-in person opening a link whose preview fails (offline, or a
server without shares:preview) is now told so and the code stays held,
instead of falling through to redeeming it. The dialog loads links and
people separately, so the links still work when the people can't be
read, and the role switches rebuild on every read so a change the server
refused shows the role it kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>