refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

common/src/bulk.rs

@@ -1,5 +1,5 @@
 //! Shared vocabulary for the admin bulk-action endpoint (`POST
-//! /web/cases/bulk`).
+//! /cases/bulk`).
 //!
 //! The wire shape is `application/x-www-form-urlencoded` with an
 //! `action=<token>` field and one or more `case_id=<uuid>` repetitions.