fix(auth): handle all PyJWT errors gracefully and enforce link code status checks

repositories/link_codes.py

@@ -32,3 +32,10 @@ async def get_link_code_by_code(session: AsyncSession, code: str) -> LinkCode |
     r = await session.execute(stmt)
 
     return r.scalar_one_or_none()
+
+
+async def use_link_code(session: AsyncSession, code: LinkCode) -> LinkCode:
+    code.status = LinkCodeStatus.USED
+    await session.commit()
+
+    return code

repositories/service_signatures.py

@@ -2,10 +2,15 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from db.models.service_signatures import ServiceSignature
+from schemas.enums import ServiceSignatureStatus
 
 
 async def get_active_signature_by_kid(session: AsyncSession, kid: str) -> ServiceSignature | None:
-    stmt = select(ServiceSignature).where(ServiceSignature.kid == kid)
+    stmt = (
+        select(ServiceSignature)
+        .where(ServiceSignature.kid == kid)
+        .where(ServiceSignature.status == ServiceSignatureStatus.ACTIVE)
+    )
     r = await session.execute(stmt)
 
     return r.scalar_one_or_none()