fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

app/(protected)/hse/incidents/[id]/capa/new/page.tsx

@@ -1,9 +1,6 @@
-export const dynamic = 'force-dynamic'
-
 import { notFound, redirect } from 'next/navigation'
 import Link from 'next/link'
 import { createClient } from '@/lib/supabase/server'
-import { createAdminClient } from '@/lib/supabase/admin'
 import { CapaForm } from '@/components/capa/capa-form'
 
 interface Props {
@@ -24,13 +21,6 @@ export default async function NewCapaPage({ params }: Props) {
     .from('incidents').select('id, reference_no, status').eq('id', id).single()
   if (!incident) notFound()
 
-  const admin = createAdminClient()
-  const { data: users } = await admin
-    .from('users')
-    .select('id, name, department')
-    .eq('active', true)
-    .order('name')
-
   return (
     <main className="max-w-lg mx-auto px-4 py-6">
       <Link href={`/hse/incidents/${id}`} className="text-sm text-blue-600 hover:underline mb-4 inline-block">
@@ -40,10 +30,7 @@ export default async function NewCapaPage({ params }: Props) {
       <p className="text-sm text-gray-500 mb-6">
         {(incident as { reference_no: string | null }).reference_no ?? id}
       </p>
-      <CapaForm
-        incidentId={id}
-        users={(users ?? []) as Array<{ id: string; name: string; department: string }>}
-      />
+      <CapaForm incidentId={id} />
     </main>
   )
 }