refactor: consolidate bulk actions, URL assembly, and case-artefact filenames

Pulls three pattern groups into shared helpers so a rename or wire-format
tweak edits one file instead of 10+:

- BulkAction enum in doctate-common replaces the "close"/"analyze"/"reset"
  string literals that were duplicated between the bulk handler and 3
  attack/CSRF test files. FromStr preserves the exact "Unbekannte Aktion"
  error shape; the handler match is now exhaustive over the enum.
- join_url helper in doctate-common absorbs 7 identical
  trim_end_matches+format! call sites across client-core, client-desktop,
  server/transcribe (ollama, whisper), and server/analyze (llm).
- server/tests/common/artefacts.rs re-exports ONELINER_FILENAME
  (doctate-common), DOCUMENT_FILE + ANALYSIS_INPUT_FILE
  (doctate-server::analyze), and CLOSE_MARKER (doctate-server::paths) so
  test files reference the canonical name instead of inlining literals.

Also lifts client-desktop local duplication:
- paths.rs: project_path helper collapses 4 identical ProjectDirs chains
- main.rs: or_die helper replaces 4 eprintln!+exit(1) blocks
- app.rs: named RecordingContext struct replaces (Uuid, String) tuple
  at 3 sites around the ffmpeg-flush finalization path

Verification: 397 tests pass (baseline was 389; +8 for new unit tests on
BulkAction and join_url), 0 failed, 4 ignored (unchanged). clippy clean.

client-desktop/src/magic_link.rs

@@ -11,7 +11,7 @@
 //! plain case URL if this fails — the doctor lands on the login page and
 //! signs in manually rather than seeing a dead button.
 
-use doctate_common::API_KEY_HEADER;
+use doctate_common::{API_KEY_HEADER, join_url};
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
@@ -42,9 +42,8 @@ pub async fn build_magic_url(
     api_key: &str,
     return_to: &str,
 ) -> Result<String, MagicLinkError> {
-    let base = server_url.trim_end_matches('/');
     let resp = http
-        .post(format!("{base}/api/auth/magic-link"))
+        .post(join_url(server_url, "/api/auth/magic-link"))
         .header(API_KEY_HEADER, api_key)
         .json(&CreateRequest { return_to })
         .send()
@@ -55,7 +54,10 @@ pub async fn build_magic_url(
     }
 
     let parsed: CreateResponse = resp.json().await?;
-    Ok(format!("{base}/web/magic?token={}", parsed.token))
+    Ok(join_url(
+        server_url,
+        &format!("/web/magic?token={}", parsed.token),
+    ))
 }
 
 #[cfg(test)]