fix verify_token function to return bool value

Return Type: The function is declared to return a bool, but you're returning a token string when the token is valid. You should change the return type to str or update your return logic.

Search for the verify_token function and inspect its return annotation, current return paths, and any callers or tests. Confirm whether the intended contract is a boolean, then update the implementation or annotation consistently and verify that valid-token behavior matches the declared return type.

Written by the indexing model from the issue text.