feat: server-authoritative case window via users.toml

The /api/oneliners time window is now read per-user from users.toml
(window_hours, default 72h). Clients no longer carry a window:
client.toml oneliner_window_hours, SyncConfig.window_hours, the
?hours=N query param, and the render_case_list cutoff filter are
gone. ETag suffix keeps the effective hours so an admin edit to
users.toml invalidates client caches on the next request.
OnelinersResponse.window_hours stays in the wire format, but now
exists solely to anchor client reconciliation.

docs/projektplan.md

@@ -352,8 +352,9 @@ Axum ist der zentrale Koordinator. Er empfängt Uploads, startet die sequentiell
 POST /api/upload                              → Aufnahme empfangen, ACK zurück
 GET  /api/health                              → Liveness-Probe für Deployments
 GET  /api/debug/whoami                        → API-Key → slug (Entwicklungshilfe)
-GET  /api/oneliners?hours=N                   → kollektive Fall-/Oneliner-Liste (ETag-basiert,
-                                                 default 16 h, max 168 h; Client-Polling)
+GET  /api/oneliners                           → kollektive Fall-/Oneliner-Liste (ETag-basiert,
+                                                 Fensterweite via users.toml->window_hours
+                                                 pro User, Default 72 h; Client-Polling)
 
 # API: Magic-Link (API-Key → Browser-Session ohne Passwort)
 POST /api/auth/magic-link                     → Einmal-Token ausstellen (X-API-Key, TTL 60 s,