fix(auth): register CAP scope, 400 on captcha, 403 for permission

Navigating from login reused a send_email_code token on register.
Captcha failure used 401 so the client stored /register as the
post-login target and never left the page. Permission denials now
return 403, and the API client no longer wipes the session on 401.

backend/plugins/domain/cap/middleware.go

@@ -17,19 +17,19 @@ func VerifyMiddleware(mgr *Manager, scope string) gin.HandlerFunc {
 			return
 		}
 		if mgr == nil {
-			response.AbortUnauthorized(c, errCapTokenInvalidOrExpired)
+			response.AbortBadRequest(c, errCapTokenInvalidOrExpired)
 			return
 		}
 
 		token := c.GetHeader("X-Cap-Token")
 		if token == "" {
-			response.AbortUnauthorized(c, errCapTokenMissing)
+			response.AbortBadRequest(c, errCapTokenMissing)
 			return
 		}
 
 		valid, err := mgr.VerifyToken(c.Request.Context(), token, scope)
 		if err != nil || !valid {
-			response.AbortUnauthorized(c, errCapTokenInvalidOrExpired)
+			response.AbortBadRequest(c, errCapTokenInvalidOrExpired)
 			return
 		}