fix(auth): handle all PyJWT errors gracefully and enforce link code status checks

repositories/service_signatures.py

@@ -2,10 +2,15 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from db.models.service_signatures import ServiceSignature
+from schemas.enums import ServiceSignatureStatus
 
 
 async def get_active_signature_by_kid(session: AsyncSession, kid: str) -> ServiceSignature | None:
-    stmt = select(ServiceSignature).where(ServiceSignature.kid == kid)
+    stmt = (
+        select(ServiceSignature)
+        .where(ServiceSignature.kid == kid)
+        .where(ServiceSignature.status == ServiceSignatureStatus.ACTIVE)
+    )
     r = await session.execute(stmt)
 
     return r.scalar_one_or_none()