fix(auth): handle all PyJWT errors gracefully and enforce link code status checks

tests/test_link_code_routes.py

@@ -93,7 +93,7 @@ def test_consume_link_code_rejects_unknown_code(client):
 
 def test_consume_link_code_rejects_code_for_deleted_user(client):
     client.app.dependency_overrides[link_codes.get_service_identity] = service_identity
-    link_code = SimpleNamespace(user_id=42)
+    link_code = SimpleNamespace(user_id=42, status=LinkCodeStatus.ACTIVE)
     repository = SimpleNamespace(get_user_by_id=AsyncMock(return_value=None))
     with (
         patch("routes.link_codes.get_link_code_by_code", new=AsyncMock(return_value=link_code)),
@@ -110,7 +110,7 @@ def test_consume_link_code_rejects_code_for_deleted_user(client):
 
 def test_consume_link_code_updates_telegram_id_and_returns_user(client):
     client.app.dependency_overrides[link_codes.get_service_identity] = service_identity
-    link_code = SimpleNamespace(user_id=42)
+    link_code = SimpleNamespace(user_id=42, status=LinkCodeStatus.ACTIVE)
     user = SimpleNamespace(
         username="alice", telegram_id=12345, referal_code="ref-code", balance=100
     )