refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

server/src/lib.rs

@@ -207,8 +207,8 @@ pub fn create_router(config: Arc<Config>) -> Router {
 /// Same as [`create_router`], but also returns a handle to the newly
 /// created session store so tests can peek at `WebSession::csrf_token`
 /// values without rendering and parsing HTML. The store handle is
-/// shared with the router (`Arc`), so any session created via `/web/login`
-/// or `/web/magic` becomes observable through it.
+/// shared with the router (`Arc`), so any session created via `/login`
+/// or `/magic` becomes observable through it.
 pub fn create_router_and_session_store(config: Arc<Config>) -> (Router, SessionStore) {
     create_router_and_session_store_with_settings(config, Arc::new(Settings::default()))
 }