fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

components/capa/capa-form.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useState } from 'react'
+import { useState, useEffect } from 'react'
 import { useRouter } from 'next/navigation'
 
 interface User {
@@ -11,11 +11,11 @@ interface User {
 
 interface Props {
   incidentId: string
-  users: User[]
 }
 
-export function CapaForm({ incidentId, users }: Props) {
+export function CapaForm({ incidentId }: Props) {
   const router = useRouter()
+  const [users, setUsers] = useState<User[]>([])
   const [description, setDescription] = useState('')
   const [ownerId, setOwnerId] = useState('')
   const [department, setDepartment] = useState('')
@@ -25,6 +25,13 @@ export function CapaForm({ incidentId, users }: Props) {
   const [saving, setSaving] = useState(false)
   const [error, setError] = useState<string | null>(null)
 
+  useEffect(() => {
+    fetch('/ims/api/users')
+      .then(r => r.json())
+      .then(data => { if (Array.isArray(data)) setUsers(data) })
+      .catch(() => {})
+  }, [])
+
   function handleOwnerChange(id: string) {
     setOwnerId(id)
     const u = users.find(u => u.id === id)

components/capa/capa-owner-actions.tsx

@@ -15,12 +15,17 @@ export function CapaOwnerActions({ capaId, currentStatus }: Props) {
   async function updateStatus(status: string) {
     setLoading(true)
     try {
-      await fetch(`/ims/api/capa/${capaId}`, {
+      const res = await fetch(`/ims/api/capa/${capaId}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ status }),
       })
+      if (!res.ok) {
+        alert('Update failed. Please try again.')
+        return
+      }
       router.refresh()
+      setTimeout(() => window.location.reload(), 300)
     } finally {
       setLoading(false)
     }