refactor(server): introduce CaseId newtype with typed Path extractor

Replace five duplicated uuid::Uuid::parse_str calls in web handlers
(analyze, document view, delete, reset, case detail) with a
CaseIdPath extractor that validates the URL segment once and
returns the legacy "Invalid case_id" 400 body byte-for-byte.

The extractor uses axum's FromRequestParts and maps any failure
to AppError::BadRequest, so IntoResponse handling is unchanged.

server/src/routes/user_web.rs

@@ -3,7 +3,7 @@ use std::sync::atomic::Ordering;
 use std::sync::Arc;
 
 use askama::Template;
-use axum::extract::{Path as AxumPath, State};
+use axum::extract::State;
 use axum::response::Html;
 use tracing::{info, warn};
 
@@ -11,6 +11,7 @@ use time::{format_description::well_known::Rfc3339, Date, OffsetDateTime};
 
 use crate::analyze::{recovery as analyze_recovery, AnalyzeSender, ANALYSIS_INPUT_FILE, DOCUMENT_FILE};
 use crate::auth::AuthenticatedWebUser;
+use crate::case_id::CaseIdPath;
 use crate::config::Config;
 use crate::error::AppError;
 use crate::routes::web::{scan_recordings, RecordingView};
@@ -263,11 +264,8 @@ pub async fn handle_case_detail(
     State(analyze_tx): State<AnalyzeSender>,
     State(transcribe_busy): State<TranscribeBusy>,
     State(transcribe_tx): State<TranscribeSender>,
-    AxumPath(case_id): AxumPath<String>,
+    CaseIdPath(case_id): CaseIdPath,
 ) -> Result<Html<String>, AppError> {
-    uuid::Uuid::parse_str(&case_id)
-        .map_err(|_| AppError::BadRequest("Invalid case_id".into()))?;
-
     // IDOR guard: case_dir must live under the session's user_slug.
     let user_root = config.data_path.join(&user.slug);
     heal_orphans_if_idle(
@@ -280,7 +278,8 @@ pub async fn handle_case_detail(
     )
     .await;
 
-    let case_dir = match locate_case(&user_root, &case_id).await {
+    let case_id_str = case_id.to_string();
+    let case_dir = match locate_case(&user_root, &case_id_str).await {
         Some(p) => p,
         None => {
             warn!(slug = %user.slug, case_id = %case_id, "case detail: not found (possible IDOR probe)");
@@ -299,12 +298,12 @@ pub async fn handle_case_detail(
     let a_busy = analyze_busy.0.load(Ordering::Acquire);
     let t_busy = transcribe_busy.0.load(Ordering::Acquire);
     let flags = compute_flags(&case_dir, &recordings, config.llm_configured(), a_busy).await;
-    let case_id_short = case_id.chars().take(8).collect();
+    let case_id_short = case_id_str.chars().take(8).collect();
     let is_admin = user.is_admin();
 
     CaseDetailTemplate {
         slug: user.slug,
-        case_id,
+        case_id: case_id_str,
         case_id_short,
         oneliner,
         recordings,