fix(auth): handle all PyJWT errors gracefully and enforce link code status checks

routes/link_codes.py

@@ -7,7 +7,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from config import cfg
 from core.deps import get_auth_context, get_service_identity
 from db.session import get_db
-from repositories.link_codes import create_link_code, get_link_code_by_code
+from repositories.link_codes import create_link_code, get_link_code_by_code, use_link_code
 from repositories.users import UserRepository
 from schemas.dto import AuthContext
 from schemas.enums import LinkCodeStatus
@@ -41,6 +41,9 @@ async def consume_link_code(
     if not link_code:
         raise HTTPException(404, detail="Code not found")
 
+    if link_code.status != LinkCodeStatus.ACTIVE:
+        raise HTTPException(404, detail="Code expired or is invalid.")
+
     users_repo = UserRepository(session)
     user = await users_repo.get_user_by_id(link_code.user_id)
 
@@ -49,6 +52,8 @@ async def consume_link_code(
 
     user = await users_repo.update_telegram_id(user, payload.telegram_id)
 
+    await use_link_code(session, code=link_code)
+
     return UserInfo(
         username=user.username,
         telegram_id=user.telegram_id,