fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

components/capa/capa-form.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useState } from 'react'
+import { useState, useEffect } from 'react'
 import { useRouter } from 'next/navigation'
 
 interface User {
@@ -11,11 +11,11 @@ interface User {
 
 interface Props {
   incidentId: string
-  users: User[]
 }
 
-export function CapaForm({ incidentId, users }: Props) {
+export function CapaForm({ incidentId }: Props) {
   const router = useRouter()
+  const [users, setUsers] = useState<User[]>([])
   const [description, setDescription] = useState('')
   const [ownerId, setOwnerId] = useState('')
   const [department, setDepartment] = useState('')
@@ -25,6 +25,13 @@ export function CapaForm({ incidentId, users }: Props) {
   const [saving, setSaving] = useState(false)
   const [error, setError] = useState<string | null>(null)
 
+  useEffect(() => {
+    fetch('/ims/api/users')
+      .then(r => r.json())
+      .then(data => { if (Array.isArray(data)) setUsers(data) })
+      .catch(() => {})
+  }, [])
+
   function handleOwnerChange(id: string) {
     setOwnerId(id)
     const u = users.find(u => u.id === id)