fix: Inline recording-delete confirm + stable redirects

- Replace native confirm() in the recording list with an inline
  two-step confirm row; hide the player via visibility:hidden
  while open so the row height stays stable.
- Hard-redirect recording delete back to /web/cases/{id}/recordings
  instead of relying on the Referer header (which silently fell
  back to /web/cases when stripped).
- Switch analyze/reset to a hidden return_to form field so the
  source page (case detail vs. case list) is preserved reliably,
  with same-origin /web/ prefix validation.
- Tighten delete_recording_test on the concrete Location header;
  adjust analyze/reset redirect expectations to the new
  case-detail fallback.

server/tests/analyze_test.rs

@@ -216,7 +216,7 @@ async fn analyze_case_happy_path_writes_input_and_redirects() {
             .unwrap()
             .to_str()
             .unwrap(),
-        "/web/cases"
+        format!("/web/cases/{case_id}")
     );
 
     let input_path = case_dir.join(ANALYSIS_INPUT_FILE);
@@ -1190,7 +1190,10 @@ async fn reset_case_clears_derived_and_unfails_audio() {
         .await
         .unwrap();
     assert_eq!(resp.status(), StatusCode::SEE_OTHER);
-    assert_eq!(resp.headers().get(header::LOCATION).unwrap(), "/web/cases");
+    assert_eq!(
+        resp.headers().get(header::LOCATION).unwrap(),
+        &format!("/web/cases/{case_id}")
+    );
 
     // Audio preserved, .failed renamed to .m4a.
     assert!(dir.join("2026-04-15T09-00-00Z.m4a").exists());