feat: server-authoritative case window via users.toml

The /api/oneliners time window is now read per-user from users.toml
(window_hours, default 72h). Clients no longer carry a window:
client.toml oneliner_window_hours, SyncConfig.window_hours, the
?hours=N query param, and the render_case_list cutoff filter are
gone. ETag suffix keeps the effective hours so an admin edit to
users.toml invalidates client caches on the next request.
OnelinersResponse.window_hours stays in the wire format, but now
exists solely to anchor client reconciliation.

server/tests/upload_test.rs

@@ -23,6 +23,7 @@ fn test_config() -> Arc<Config> {
             role: "doctor".into(),
             whisper: Default::default(),
             retention: Default::default(),
+            window_hours: 72,
         }],
         api_keys: HashMap::from([("test-key-123".into(), "dr_test".into())]),
         ..Config::test_default()