fix: Inline recording-delete confirm + stable redirects

- Replace native confirm() in the recording list with an inline
  two-step confirm row; hide the player via visibility:hidden
  while open so the row height stays stable.
- Hard-redirect recording delete back to /web/cases/{id}/recordings
  instead of relying on the Referer header (which silently fell
  back to /web/cases when stripped).
- Switch analyze/reset to a hidden return_to form field so the
  source page (case detail vs. case list) is preserved reliably,
  with same-origin /web/ prefix validation.
- Tighten delete_recording_test on the concrete Location header;
  adjust analyze/reset redirect expectations to the new
  case-detail fallback.

server/templates/case_page.html

@@ -385,6 +385,7 @@
             {% if can_analyze && !has_document %}
             <form method="post" action="/web/cases/{{ case_id }}/analyze">
                 {% call csrf::field(csrf_token) %}
+                <input type="hidden" name="return_to" value="/web/cases/{{ case_id }}">
                 <button type="submit">Analysieren</button>
             </form>
             {% else if llm_missing && !has_document %}
@@ -396,6 +397,7 @@
                 action="/web/cases/{{ case_id }}/reset"
             >
                 {% call csrf::field(csrf_token) %}
+                <input type="hidden" name="return_to" value="/web/cases/{{ case_id }}">
                 <button type="submit">Reset</button>
             </form>
             {% endif %}
@@ -407,6 +409,7 @@
             <div class="doc-actions-top">
                 <form method="post" action="/web/cases/{{ case_id }}/analyze">
                     {% call csrf::field(csrf_token) %}
+                    <input type="hidden" name="return_to" value="/web/cases/{{ case_id }}">
                     <button
                         type="submit"
                         class="copy-btn"