fix: Magic-link revoke-by-prefix can revoke wrong token (4-hex minimum)

[patil2001]

Summary

:866-875 accepts 4-char prefix; startswith match on 65k space.

Impact: Production user/operator failure on Osmantic/ODS main

Files:

• dashboard-api/routers/magic_link.py
• tests/test_magic_link.py

Repro

On a production-like Osmantic/ODS main checkout:

1. Hit the failure mode described in Summary (severity: Medium).
2. Observe the broken behavior / incorrect exit / missing guard from the root cause above.
3. Confirm no overlapping open PR (dedup: Distinct from Magic-link token hash compared with == instead of a constant-time comparison (dashboard-api magic_link.py:335) #3342 (redemption timing compare).).

Fix

Implement a minimal, distro-/path-correct fix in the listed files (no scope creep).

• Address the root cause directly (do not paper over with || true / broad catches).
• Prefer resolving runtime values from the environment/repo (like apt-cache madison) over hardcoding distro-specific version strings when the same bug class applies.
• Add a regression test under ods/tests/ (or matching suite) that fails without the fix and passes with it.

Context

Filed from Desktop issues.md entry #28 via one-click scout pipeline.
Rationale: Unfiled Desktop issues.md #28 (no GitHub issue yet)