fix(auth): resolve JWT InvalidSignatureError and improve frontend UX

- Fix auth by using idToken fallback when accessToken audience mismatches
- Add PyJWT verification with audience-aware token selection in frontend
- Source health: track last_attempt_time and error status per source
- Frontend: fix modal outside x-data scope, add circular-safe JSON stringify
- Frontend: support multi-select service filter with All/None toggles
- Frontend: improve filter layout into organized rows
- Frontend: fix text overflow and result pill colors (success/succeeded)
- Intune: normalize application actors (auditActorType=Application)
- Add cache-control middleware for HTML/API responses
- Update tests for multi-service filtering and source health

backend/watermark.py

@@ -9,10 +9,15 @@ def get_watermark(source: str) -> str | None:
     return doc.get("last_fetch_time") if doc else None
 
 
-def set_watermark(source: str, timestamp: str):
-    """Persist the latest successful fetch timestamp for a source."""
+def set_watermark(source: str, timestamp: str, status: str | None = None):
+    """Persist the latest fetch attempt timestamp and optional status for a source."""
+    doc: dict = {"last_attempt_time": timestamp}
+    if status == "healthy":
+        doc["last_fetch_time"] = timestamp
+    if status:
+        doc["status"] = status
     watermarks_collection.update_one(
         {"source": source},
-        {"$set": {"last_fetch_time": timestamp}},
+        {"$set": doc},
         upsert=True,
     )