fix: verifyConnection binds client handle instead of stored pending handle

server/modules/codeforces/service.js

@@ -35,7 +35,7 @@
   let longestStreak = 0;
   let tempStreak = 0;
 
   const today = new Date().toISOString().slice(0, 10);
   const sortedDesc = [...dates].reverse();
 
   for (let i = 0; i < sortedDesc.length; i++) {
@@ -147,7 +147,7 @@
     let cfUsers;
     try {
       cfUsers = await cfGetUserInfo(handle);
     } catch (err) {
       throw new ApiError(404, `Codeforces handle "${handle}" not found.`);
     }
 
@@ -205,6 +205,12 @@
       throw new ApiError(400, "No pending verification. Please re-initiate connection.");
     }
 
+    // Bind to the handle vetted during initiateConnection (the one the
+    // duplicate-handle uniqueness guard ran against), not whatever the client
+    // re-sends now. Otherwise the finally-bound handle can diverge from the one
+    // that passed the uniqueness check, producing inconsistent state.
+    handle = profile.handle;
+
     if (new Date() > profile.verificationExpiry) {
       throw new ApiError(400, "Verification code expired. Please re-initiate connection.");
     }