Document DNS-compliant token format for preview URLs

Preview URL tokens now use only DNS-valid characters (lowercase
alphanumeric and hyphens) per RFC 952/1123. Updated security section
to clarify token format and compliance requirements.

Related to cloudflare/sandbox-sdk#247

Author: github-actions[bot]

src/content/docs/sandbox/concepts/preview-urls.mdx

@@ -155,7 +155,7 @@ Preview URLs are publicly accessible by default, but require a valid access toke
 
 **Built-in security**:
 
-- **Token-based access** - Each exposed port gets a unique token in the URL (for example, `https://8080-sandbox-abc123token.yourdomain.com`)
+- **Token-based access** - Each exposed port gets a unique token in the URL (for example, `https://8080-sandbox-abc123token.yourdomain.com`). Tokens are 16 characters long and use only lowercase alphanumeric characters and hyphens, complying with DNS hostname requirements (RFC 952/1123).
 - **HTTPS in production** - All traffic is encrypted with automatic TLS
 - **Unpredictable URLs** - Tokens are randomly generated and difficult to guess