feat: add POST /web/cases/purge-closed for bulk hard-delete

Iterates the user's data dir and removes every case directory that
carries a .closed marker. Requires form field confirm=yes as a server-
side guard against accidental browser-history re-POSTs. Emits CasePurged
per successfully removed case; per-case failures are logged but do not
abort the sweep.

UI button is deferred to the show-closed step so the endpoint is only
reachable after an explicit navigation. Three integration tests cover
the happy path, missing-confirm, and coexistence with open cases.

server/src/routes/mod.rs

@@ -54,6 +54,10 @@ pub fn api_router() -> Router<AppState> {
             "/web/cases/{case_id}/reset",
             post(case_actions::handle_reset_case),
         )
+        .route(
+            "/web/cases/purge-closed",
+            post(case_actions::handle_purge_closed),
+        )
         .route("/web/cases/bulk", post(bulk::handle_bulk_action))
         .route(
             "/web/audio/{user}/{case_id}/{filename}",