Gate the company-settings preview page behind Draft Mode

Unlike the email-templates preview (marketing copy), this page shows
real bank/address details once filled in — it must not render for an
unauthenticated visitor who finds the URL.

README.md

@@ -408,9 +408,12 @@ updating as the admin edits `sellerName`/address/`taxRatePercent`/
 
 - **`app/company-settings-preview/page.tsx`** + **`components/LiveCompanySettingsPreviewClient.tsx`**
   — same entrypoint pattern as `/email-preview/[type]` (Draft Mode via
-  `app/api/preview/route.ts`, never a real visitor destination), but no
-  `[type]` segment — there's only one kind of document here, unlike the 6
-  email types.
+  `app/api/preview/route.ts`), but no `[type]` segment — there's only one
+  kind of document here, unlike the 6 email types. **Actually gated on
+  `draftMode().isEnabled`** (calls `notFound()` otherwise), unlike
+  `/email-preview` — this data includes a real bank IBAN/address once
+  filled in, not just marketing email copy, so it must not render for an
+  unauthenticated visitor who happens to find the URL.
 - **`@react-pdf/renderer`'s `<PDFViewer>`** (not `renderToBuffer()`) is
   what makes this a *live* preview rather than a static download — it's a
   browser-only component that renders a `Document` straight into an