fix(auth): register CAP scope, 400 on captcha, 403 for permission

Navigating from login reused a send_email_code token on register.
Captcha failure used 401 so the client stored /register as the
post-login target and never left the page. Permission denials now
return 403, and the API client no longer wipes the session on 401.

backend/plugins/domain/auth/middleware.go

@@ -162,15 +162,13 @@ func AdminRequired() gin.HandlerFunc {
 		isTokenAuth, _ := ginutil.GetFromContext[bool](c, contracts.AuthTokenAuthKey)
 		isTokenAdmin, _ := ginutil.GetFromContext[bool](c, contracts.AuthTokenAdminKey)
 
-		// 如果是通过 Token 鉴权，要求该 Token 具备管理员权限或者用户本身为管理员
+		// Logged-in but lacking admin permission is 403, not 401/404.
 		if isTokenAuth && !isTokenAdmin && !user.IsAdmin {
-			response.AbortNotFound(c, errTokenAdminRequired)
+			response.AbortForbidden(c, errInsufficientPermission)
 			return
 		}
-
-		// 如果是通过 Session 鉴权，直接检查用户的 is_admin 属性
 		if !isTokenAuth && !user.IsAdmin {
-			response.AbortNotFound(c, errAdminRequired)
+			response.AbortForbidden(c, errInsufficientPermission)
 			return
 		}