Addresses static analysis security warning S105 flagged in PR #40 review about hardcoded token type in Token schema.

Changes

• Added DEFAULT_TOKEN_TYPE constant to app/config.py for centralizing OAuth2 token type configuration
• Updated Token schema in app/schemas.py to reference the constant instead of inline string literal
• Suppressed false-positive S105 warning with inline annotation (token type is not a password)

# Before
class Token(BaseModel):
    access_token: str
    token_type: str = "bearer"
    refresh_token: str | None = None

# After
from app.config import DEFAULT_TOKEN_TYPE

class Token(BaseModel):
    access_token: str
    token_type: str = DEFAULT_TOKEN_TYPE
    refresh_token: str | None = None

This eliminates the static analysis warning while maintaining backward compatibility and improving maintainability.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.