refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

server/tests/reset_case_test.rs

@@ -1,4 +1,4 @@
-//! Admin-only case reset endpoint: POST /web/cases/{case_id}/reset.
+//! Admin-only case reset endpoint: POST /cases/{case_id}/reset.
 //!
 //! Verifies the sticky-Manual rule for the reset path: a clinician-set
 //! `OnelinerState::Manual` must survive an admin-triggered reset, while
@@ -58,7 +58,7 @@ async fn reset_case_preserves_manual_oneliner_override() {
     assert_eq!(resp.status(), StatusCode::SEE_OTHER);
     assert_eq!(
         resp.headers().get(header::LOCATION).unwrap(),
-        &format!("/web/cases/{case_id}")
+        &format!("/cases/{case_id}")
     );
 
     // Recording metadata sidecar was wiped (the rest of the reset