- auth callback: remove debug redirect, handle both code (PKCE) and
token_hash+type (recovery/magic link) flows correctly
- capa PATCH: use admin client to bypass RLS for status updates
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ