refactor: drop /web/ URL prefix from browser routes

The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.

The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.

Pre-production: no transition redirects.

server/tests/sse_integration.rs

@@ -1,4 +1,4 @@
-//! Integration tests for the `/web/events` SSE route.
+//! Integration tests for the `/events` SSE route.
 //!
 //! We test two things end-to-end:
 //! 1. Without a session cookie, the route redirects to the login page