refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

server/src/main.rs

@@ -131,7 +131,7 @@ async fn main() {
     });
 
     // Live-update bus: background workers and handlers publish case
-    // events here; the SSE route at `/web/events` fans them out to
+    // events here; the SSE route at `/events` fans them out to
     // subscribed browsers.
     let events_tx = events::channel();