rename JWKS_URL → IAM_KEYS_URL + IAM_ENDPOINT → IAM_URL

Aligns base with the canonical IAM_* env set defined by
hanzoai/kms fe6aca7:
  IAM_URL       — where IAM lives
  IAM_KEYS_URL  — JWKS endpoint

The standalone example in examples/base/main.go now reads
IAM_URL / KMS_URL for endpoint config — drops the
IAM_ENDPOINT / KMS_ENDPOINT alias.

No back-compat fallbacks.

apis/base.go

@@ -38,15 +38,15 @@ func NewRouter(app core.App) (*router.Router[*core.RequestEvent], error) {
 
 	// External auth mode: allow JWKS-based auth without the platform plugin.
 	// EXTERNAL_AUTH_ONLY=true disables all built-in auth endpoints for
-	// non-superuser collections and requires JWKS_URL for token validation.
+	// non-superuser collections and requires IAM_KEYS_URL for token validation.
 	// The platform plugin sets these store keys directly; env vars provide
 	// the same behavior for standalone Base deployments.
 	if os.Getenv("EXTERNAL_AUTH_ONLY") == "true" {
-		jwksURL := os.Getenv("JWKS_URL")
+		jwksURL := os.Getenv("IAM_KEYS_URL")
 		if jwksURL != "" {
 			app.Store().Set(StoreKeyJWKSURL, jwksURL)
 		} else {
-			app.Logger().Warn("EXTERNAL_AUTH_ONLY is set but JWKS_URL is empty — token validation will fail")
+			app.Logger().Warn("EXTERNAL_AUTH_ONLY is set but IAM_KEYS_URL is empty — token validation will fail")
 		}
 		app.Store().Set(StoreKeyExternalAuthOnly, true)
 

examples/base/main.go

@@ -112,8 +112,8 @@ func main() {
 
 	// Multi-tenant platform (IAM + KMS integration)
 	platform.MustRegister(app, platform.PlatformConfig{
-		IAMEndpoint:     os.Getenv("IAM_ENDPOINT"),
-		KMSEndpoint:     os.Getenv("KMS_ENDPOINT"),
+		IAMEndpoint:     os.Getenv("IAM_URL"),
+		KMSEndpoint:     os.Getenv("KMS_URL"),
 		IAMClientID:     os.Getenv("IAM_CLIENT_ID"),
 		IAMClientSecret: os.Getenv("IAM_CLIENT_SECRET"),
 	})