fix: getconfirmationcode query

backend/internal/database/query.sql.go

@@ -231,7 +231,12 @@ func (q *Queries) DeleteUserByUsername(ctx context.Context, username string) err
 
 const getConfirmationCodeByCode = `-- name: GetConfirmationCodeByCode :one
 SELECT id, user_id, code_type, code_hash, expires_at, used, deleted FROM confirmation_codes
-WHERE user_id = $1 AND code_type = $2 AND expires_at > CURRENT_TIMESTAMP AND code_hash = crypt($3::text, code_hash)
+WHERE 
+  user_id = $1 AND
+  code_type = $2 AND
+  expires_at > CURRENT_TIMESTAMP AND
+  used IS FALSE AND
+  code_hash = crypt($3::text, code_hash)
 `
 
 type GetConfirmationCodeByCodeParams struct {