fix(auth): register CAP scope, 400 on captcha, 403 for permission

Navigating from login reused a send_email_code token on register.
Captcha failure used 401 so the client stored /register as the
post-login target and never left the page. Permission denials now
return 403, and the API client no longer wipes the session on 401.

frontend/components/auth/cap-widget.tsx

@@ -60,13 +60,13 @@ export function CapWidget({
     }
   };
 
-  // Auto-start on mount (only when autoStart is enabled)
   useEffect(() => {
+    solving.current = false;
     if (autoStart) {
       void solve();
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, []);
+  }, [autoStart, scope]);
 
   return (
     <div className='flex items-center gap-2 rounded-lg border border-border/60 bg-muted/30 px-3 py-2 text-sm'>