Function object_head 

pub async fn object_head(
    profile_id: ProfileId,
    bucket: String,
    key: String,
    version_id: Option<String>,
    store: State<'_, ProfileStoreHandle>,
    pool: State<'_, S3ClientPoolHandle>,
) -> Result<ObjectHead, AppError>

Fetch HEAD-only metadata for a single S3 object.

Lighter than object_inspect — only calls HeadObject, no tag or ACL fetches. Used by the preview pane to obtain contentLength (for the size- limit check) and contentType (for MIME routing) without the overhead of the full inspector report.

Validation gate

Refuses to serve data for profiles that have not been validated in the current session (AC-8 / round-1 finding #9).