feat: add POST /web/cases/purge-closed for bulk hard-delete

Iterates the user's data dir and removes every case directory that
carries a .closed marker. Requires form field confirm=yes as a server-
side guard against accidental browser-history re-POSTs. Emits CasePurged
per successfully removed case; per-case failures are logged but do not
abort the sweep.

UI button is deferred to the show-closed step so the endpoint is only
reachable after an explicit navigation. Three integration tests cover
the happy path, missing-confirm, and coexistence with open cases.

server/src/events.rs

@@ -32,6 +32,7 @@ pub enum CaseEventKind {
     DocumentReady,
     CaseClosed,
     CaseReopened,
+    CasePurged,
     CaseReset,
 }
 

server/src/routes/case_actions.rs

@@ -22,7 +22,7 @@ use crate::case_id::CaseIdPath;
 use crate::config::Config;
 use crate::error::AppError;
 use crate::events::{self, CaseEventKind, EventSender};
-use crate::paths::{CLOSE_MARKER, CloseMarker, write_close_marker};
+use crate::paths::{CLOSE_MARKER, CloseMarker, read_close_marker, write_close_marker};
 use crate::routes::user_web::locate_case_or_404;
 use crate::routes::web::validate_filename;
 
@@ -394,6 +394,78 @@ pub async fn handle_reset_case(
     Ok(Redirect::to(&resolve_return_path(&headers)))
 }
 
+#[derive(Deserialize)]
+pub struct PurgeClosedForm {
+    // Optional so a missing field yields a clean 400 from our handler
+    // rather than a 422 from axum's form extractor.
+    #[serde(default)]
+    pub confirm: String,
+}
+
+/// POST /web/cases/purge-closed
+///
+/// Hard-delete every case under the user's data dir that carries a
+/// `.closed` marker. Requires form field `confirm=yes` as a server-side
+/// guard against accidental browser-history re-POSTs — the UI additionally
+/// shows a JS confirm() dialog, but that can be defeated by re-submitting
+/// the form from history, so the server double-checks.
+///
+/// Per-case failures are logged but do not abort the sweep. Emits
+/// `CasePurged` per successfully removed case.
+pub async fn handle_purge_closed(
+    user: AuthenticatedWebUser,
+    State(config): State<Arc<Config>>,
+    State(events_tx): State<EventSender>,
+    Form(form): Form<PurgeClosedForm>,
+) -> Result<Redirect, AppError> {
+    if form.confirm != "yes" {
+        warn!(slug = %user.slug, "purge-closed: missing confirm=yes");
+        return Err(AppError::BadRequest("Missing confirm=yes".into()));
+    }
+
+    let user_root = config.data_path.join(&user.slug);
+    let mut ok = 0usize;
+    let mut skipped = 0usize;
+    let mut entries = match tokio::fs::read_dir(&user_root).await {
+        Ok(r) => r,
+        Err(e) => {
+            warn!(slug = %user.slug, error = %e, "purge-closed: read_dir failed");
+            return Ok(Redirect::to("/web/cases"));
+        }
+    };
+    while let Ok(Some(entry)) = entries.next_entry().await {
+        let case_path = entry.path();
+        if !case_path.is_dir() {
+            continue;
+        }
+        if !crate::paths::is_closed(&case_path).await {
+            continue;
+        }
+        // Read the marker up-front so the log line has context even
+        // if remove_dir_all later fails partway through.
+        let closed_at = read_close_marker(&case_path)
+            .await
+            .map(|m| m.closed_at)
+            .unwrap_or_else(|| "<malformed>".to_string());
+        let case_id = crate::events::case_id_of(&case_path);
+        if let Err(e) = tokio::fs::remove_dir_all(&case_path).await {
+            warn!(slug = %user.slug, case_id = %case_id, error = %e, "purge-closed: remove_dir_all failed");
+            skipped += 1;
+            continue;
+        }
+        info!(
+            slug = %user.slug,
+            case_id = %case_id,
+            closed_at = %closed_at,
+            "case purged (manual bulk)"
+        );
+        events::emit(&events_tx, &user.slug, case_id, CaseEventKind::CasePurged);
+        ok += 1;
+    }
+    info!(slug = %user.slug, ok, skipped, "purge-closed completed");
+    Ok(Redirect::to("/web/cases"))
+}
+
 #[derive(Deserialize)]
 pub struct DeleteRecordingForm {
     pub filename: String,

server/src/routes/mod.rs

@@ -54,6 +54,10 @@ pub fn api_router() -> Router<AppState> {
             "/web/cases/{case_id}/reset",
             post(case_actions::handle_reset_case),
         )
+        .route(
+            "/web/cases/purge-closed",
+            post(case_actions::handle_purge_closed),
+        )
         .route("/web/cases/bulk", post(bulk::handle_bulk_action))
         .route(
             "/web/audio/{user}/{case_id}/{filename}",