fix(auth): register CAP scope, 400 on captcha, 403 for permission

Navigating from login reused a send_email_code token on register.
Captcha failure used 401 so the client stored /register as the
post-login target and never left the page. Permission denials now
return 403, and the API client no longer wipes the session on 401.

backend/plugins/domain/auth/plugin_test.go

@@ -40,6 +40,7 @@ type testUser struct {
 	ID          uint64 `gorm:"primaryKey"`
 	Username    string
 	IsActive    bool
+	IsAdmin     bool
 	LastLoginAt time.Time
 }