feat: server-authoritative case window via users.toml

The /api/oneliners time window is now read per-user from users.toml
(window_hours, default 72h). Clients no longer carry a window:
client.toml oneliner_window_hours, SyncConfig.window_hours, the
?hours=N query param, and the render_case_list cutoff filter are
gone. ETag suffix keeps the effective hours so an admin edit to
users.toml invalidates client caches on the next request.
OnelinersResponse.window_hours stays in the wire format, but now
exists solely to anchor client reconciliation.

server/tests/case_page_test.rs

@@ -24,6 +24,7 @@ fn make_user(slug: &str) -> User {
         role: "doctor".into(),
         whisper: Default::default(),
         retention: Default::default(),
+        window_hours: 72,
     }
 }