convert reused strings to constants

netlify/functions/client-metadata.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
+import { CONFIG } from "./core/config/constants";
 
 export const handler: Handler = async (
   event: HandlerEvent,
···
           client_name: "ATlast (Local Dev)",
           client_uri: appUrl,
           redirect_uris: [redirectUri],
-          scope: "atproto repo:app.bsky.graph.follow",
+          scope: CONFIG.OAUTH_SCOPES,
           grant_types: ["authorization_code", "refresh_token"],
           response_types: ["code"],
           application_type: "web",
···
       client_uri: appUrl,
       redirect_uris: [redirectUri],
       logo_uri: logoUri,
-      scope: "atproto transition:generic",
+      scope: CONFIG.OAUTH_SCOPES,
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       application_type: "web",

netlify/functions/core/config/constants.ts

···
   PROFILE_CACHE_TTL: 5 * 60 * 1000, // 5 minutes
   SESSION_EXPIRY: 30 * 24 * 60 * 60 * 1000, // 30 days
   STATE_EXPIRY: 10 * 60 * 1000, // 10 minutes
-  COOKIE_MAX_AGE: 2592000, // 30 days in seconds
+  COOKIE_MAX_AGE: 2592000, // 30 days in seconds,
+  OAUTH_KEY_ID: "main-key", // jwks kid
+  OAUTH_SCOPES: "atproto transition:generic", // future?: atproto repo:app.bsky.graph.follow?action=create repo:so.sprk.graph.follow?action=create repo:sh.tangled.graph.follow?action=create
 } as const;

netlify/functions/infrastructure/oauth/OAuthClientFactory.ts

···
 import { ApiError } from "../../core/errors";
 import { stateStore, sessionStore } from "./stores";
 import { getOAuthConfig } from "./config";
+import { CONFIG } from "../../core/config/constants";
 
 function normalizePrivateKey(key: string): string {
   if (!key.includes("\n") && key.includes("\\n")) {
···
     }
 
     const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
-    const privateKey = await JoseKey.fromImportable(normalizedKey, "main-key");
+    const privateKey = await JoseKey.fromImportable(
+      normalizedKey,
+      CONFIG.OAUTH_KEY_ID,
+    );
 
     return new NodeOAuthClient({
       clientMetadata: {
···
         client_name: "ATlast",
         client_uri: config.clientId.replace("/oauth-client-metadata.json", ""),
         redirect_uris: [config.redirectUri],
-        scope: "atproto transition:generic",
+        scope: CONFIG.OAUTH_SCOPES,
         grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
         application_type: "web",

netlify/functions/infrastructure/oauth/config.ts

···
 import { OAuthConfig } from "../../core/types";
 import { ApiError } from "../../core/errors";
 import { configCache } from "../cache/CacheService";
+import { CONFIG } from "../../core/config/constants";
 
 export function getOAuthConfig(event?: {
   headers: Record<string, string | undefined>;
···
         "redirect_uri",
         `http://127.0.0.1:${port}/.netlify/functions/oauth-callback`,
       ],
-      ["scope", "atproto transition:generic"],
+      ["scope", CONFIG.OAUTH_SCOPES],
     ])}`;
 
     console.log("Using loopback OAuth for local development");

netlify/functions/jwks.ts

···
 import { Handler } from "@netlify/functions";
+import { CONFIG } from "./core/config/constants";
 
 const PUBLIC_JWK = {
   kty: "EC",
   x: "3sVbr4xwN7UtmG1L19vL0x9iN-FRcl7p-Wja_xPbhhk",
   y: "Y1XKDaAyDwijp8aEIGHmO46huKjajSQH2cbfpWaWpQ4",
   crv: "P-256",
-  kid: "main-key",
+  kid: CONFIG.OAUTH_KEY_ID,
   use: "sig",
   alg: "ES256",
 };

netlify/functions/oauth-start.ts

···
 import { successResponse } from "./utils";
 import { withErrorHandling } from "./core/middleware";
 import { ValidationError } from "./core/errors";
+import { CONFIG } from "./core/config/constants";
 
 interface OAuthStartRequestBody {
   login_hint?: string;
···
   const client = await createOAuthClient(event);
 
   const authUrl = await client.authorize(loginHint, {
-    scope: "atproto transition:generic",
+    scope: CONFIG.OAUTH_SCOPES,
   });
 
   console.log("[oauth-start] Generated auth URL for:", loginHint);