fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

app/api/auth/callback/route.ts

@@ -1,20 +1,24 @@
-// app/api/auth/callback/route.ts
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
+import type { EmailOtpType } from '@supabase/supabase-js'
 
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url)
   const code = searchParams.get('code')
+  const token_hash = searchParams.get('token_hash')
+  const type = searchParams.get('type') as EmailOtpType | null
   const nextRaw = searchParams.get('next') ?? '/'
   const next = nextRaw.startsWith('/') && !nextRaw.startsWith('//') ? nextRaw : '/'
   const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
 
+  const supabase = await createClient()
+
   if (code) {
-    const supabase = await createClient()
     const { error } = await supabase.auth.exchangeCodeForSession(code)
-    if (!error) {
-      return NextResponse.redirect(`${appUrl}${next}`)
-    }
+    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
+  } else if (token_hash && type) {
+    const { error } = await supabase.auth.verifyOtp({ token_hash, type })
+    if (!error) return NextResponse.redirect(`${appUrl}${next}`)
   }
 
   return NextResponse.redirect(`${appUrl}/login?error=auth_callback_failed`)