Fix/inactive streams

[TheShnider]

closes #812

[ogazboiz]

closing as superseded by #970. you both edited the exact same auth-jwt signature-tamper line (you flip a middle character, #970 replaces the whole signature with an invalid string) and they conflict, so only one can land. #970 is the larger sorobanService change and already makes that test's signature reliably invalid. your middle-char approach was the more surgical one though, good catch on the weak last-char tamper. thanks!