fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

.superpowers/sdd/progress.md

@@ -112,3 +112,55 @@ Branch: phase-5-6
 - [x] Drive-by: fixed 9 pre-existing missing /ims basePath prefixes
 
 Verification: 112 tests passing (23 files), tsc clean, next build clean.
+
+---
+
+# Bugfix SDD Progress Ledger
+
+Plan: docs/superpowers/plans/2026-07-17-bugfixes-invite-capa-drugtest.md
+Started: 2026-07-17
+Base commit: e682162
+
+## Tasks
+
+- [x] Task 1: Fix invite redirect URL — commit a3ce59f, review clean
+- [x] Task 2: CAPA Assigned To — commit e687510, review clean
+- [x] Task 3: Split alcohol/urine test — commits e30d583..ac2f072, review clean (2 minor: as never cast in supervisor page; cosmetic single-test grid)
+
+## Final Review (2026-07-17)
+Verdict: Approved — ready to merge
+Minor findings (non-blocking):
+- alcohol_test_result missing CHECK constraint (urine_test_result has it) — asymmetric, follow-up migration
+- PATCH audit_log only on complete=true, not on every field save — pre-existing gap
+- supervisor page `as never` cast — already logged
+- cosmetic single-test grid — already logged
+
+# Remove Invite-by-Email SDD Progress Ledger
+
+Plan: docs/superpowers/plans/2026-07-18-remove-invite-by-email.md
+Started: 2026-07-18
+Base commit: ac2f072
+
+## Tasks
+
+- [x] Task 1: Strip invite mode from UI + API — commit 33d4dd4, review clean (minor: audit log skipped on DELETE when target row null; unreachable ?? fallback in DELETE)
+- [x] Task 2: Delete invite-callback page — no commit needed (files were untracked), review clean
+
+## Final Review (2026-07-18)
+Verdict: Approved after fix
+- Important fixed: orphaned auth user on profile update failure — commit d5803da
+- Minor (non-blocking): confirmDeleteId cleared before error check in deleteUser; no client-side guard disabling Delete for own account row
+
+# Forgot Password SDD Progress Ledger
+
+Plan: docs/superpowers/plans/2026-07-21-forgot-password.md
+Started: 2026-07-21
+Base commit: 3a5daaa
+
+## Tasks
+
+- [x] Task 1: Add "Forgot password?" link to login form (commit 4d7ab5d, review clean)
+- [x] Task 2: Create forgot-password page (commit 211117e, review clean — reviewer finding 1 false positive: /reset-password page created by Task 3; finding 3 false positive: disabled={loading} already on button; finding 2 minor: appUrl fallback non-blocking, NEXT_PUBLIC_APP_URL set in .env.production)
+- [x] Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
+- [x] Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
+- [x] Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)