auth_proxy still proxied login/signup/userinfo/send-verification-code at a
prefix the edge refuses with 403, while iam.go beside it had already moved.
One dialect now, matching the rest of the package.
The guard reads string literals through go/ast rather than grepping lines, so
a comment recording a dead upstream path stays documentation and only a real
route can fail the build.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>