Fix magic login: URL generation, admin redirect, Wordfence reCAPTCHA

[ManniGH]

Three fixes to MagicLoginHandler.php:

1. Fix magic login URL base path (getMagicLoginUrl)

   • Changed site_url('index.php') to site_url('/')
   • Eliminates unnecessary 301 redirect caused by server-level rewrite rules stripping index.php, which was preventing makeLogin() from processing the token correctly.

2. Fix wp-admin redirect for non-admin users (handleMagicLoginAjax)

   • Added check to ignore redirect_to=/wp-admin/ destinations for users without manage_options capability
   • Falls back to home_url('/') for non-admin users
   • Prevents non-admin users being bounced to wp-login.php?reauth=1

3. Fix Wordfence reCAPTCHA compatibility (register)

   • Added wordfence_ls_require_captcha filter to bypass reCAPTCHA check when processing fls_al magic login requests
   • Magic login never loads the login page normally so reCAPTCHA JS never runs, causing Wordfence to treat it as a bot
   • Filter degrades gracefully when Wordfence is not installed

Infrastructure note:
The site_url('index.php') bug was particularly damaging on hosts running
Cloudflare, where the resulting 301 redirect caused Set-Cookie headers to
be stripped before reaching the browser, silently voiding the auth cookie.
Removing the 301 entirely by using site_url('/') resolves this. Users on
Cloudflare-backed hosts (e.g. Rocket.net) may also need to ensure
Set-Cookie headers are preserved on 302 redirect responses for URLs
matching /?fls_al=* — this is a host-level configuration, not a plugin fix.