fae15ad66b
A 403 from the claim URL means the token was already used or is invalid. Throw InvalidOperationException so the middleware returns a 400 with a helpful message instead of a generic 500. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>