fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

app/api/capa/[id]/route.ts

@@ -2,6 +2,7 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { createAdminClient } from '@/lib/supabase/admin'
 
 export async function GET(
   _: NextRequest,
@@ -74,7 +75,8 @@ export async function PATCH(
     update.completed_at = new Date().toISOString()
   }
 
-  const { error } = await supabase
+  const admin = createAdminClient()
+  const { error } = await admin
     .from('capa_actions')
     .update(update)
     .eq('id', id)