de-duplicate the configure-workflow url shape across frontend (TS) and backend (Python)

### Context

Raised during review of #1484.

The configure-workflow / assistant-handoff URL shape is hardcoded **independently** in two places:

- Frontend (TS): `packages/shared/routes/constants.ts`
- Backend (Python): `compute_handoff` in `backend/api/app/services/assistant_agent.py`

They are coupled only by magic-string literals in tests, and had to be edited in lockstep in #1484. This is the same coupling class that caused the original assistant → stepper handoff mismatch (#1295). Note `_format_trs_id_for_url` / `_sanitize_entity_id` are already hand-mirrors of the frontend helpers — this URL shape would be the third.

### Options

1. Have `compute_handoff` return **identifiers** (entity id, trs id, data source, accessions) and let the frontend build the URL — single source of truth for the URL shape.
2. Or define a shared route contract + a cross-language contract test that fails when TS and Python drift.

### Related

- #1295 (original handoff investigation)
- #1487

### Acceptance criteria

- The configure-workflow URL shape is defined in one place (or drift is caught by an automated cross-language test).