refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

server/tests/case_page_test.rs

@@ -17,7 +17,7 @@ async fn login_dr_a(app: &axum::Router) -> String {
 }
 
 // ---------------------------------------------------------------------
-// GET /web/cases/{id}  — case page
+// GET /cases/{id}  — case page
 // ---------------------------------------------------------------------
 
 #[tokio::test]
@@ -320,7 +320,7 @@ async fn case_page_foreign_user_returns_404() {
 }
 
 // ---------------------------------------------------------------------
-// GET /web/cases/{id}/recordings  — recordings sub-page
+// GET /cases/{id}/recordings  — recordings sub-page
 // ---------------------------------------------------------------------
 
 #[tokio::test]
@@ -373,7 +373,7 @@ async fn case_recordings_back_link_targets_case_page() {
 
     assert!(
         body.contains(&format!(r#"href="{}""#, paths::case_detail(case_id))),
-        "back link must target the case page, not /web/cases"
+        "back link must target the case page, not /cases"
     );
 }