fix(auth,capa): restore auth callback, fix CAPA status update

- auth callback: remove debug redirect, handle both code (PKCE) and
  token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ

components/capa/capa-owner-actions.tsx

@@ -15,12 +15,17 @@ export function CapaOwnerActions({ capaId, currentStatus }: Props) {
   async function updateStatus(status: string) {
     setLoading(true)
     try {
-      await fetch(`/ims/api/capa/${capaId}`, {
+      const res = await fetch(`/ims/api/capa/${capaId}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ status }),
       })
+      if (!res.ok) {
+        alert('Update failed. Please try again.')
+        return
+      }
       router.refresh()
+      setTimeout(() => window.location.reload(), 300)
     } finally {
       setLoading(false)
     }