docs+ui: neutralize legacy upstream brand references; add NOTICE

Replace inline upstream-brand mentions in DEPRECATED.md, LLM.md, and a
frontend gap description with neutral 'legacy fork' wording. Add a NOTICE
file carrying the required upstream MIT attribution. The LICENSE retains
the upstream copyright notice as required by the MIT license; that is the
only place the upstream name remains.

No functional changes. Go backend and frontend build unchanged.

DEPRECATED.md

@@ -9,7 +9,7 @@ lives at:
 
 This repo is archived as `kms-v1` for historical reference. The active
 implementation is **Go-native, MPC-backed, ZapDB-storage** — replacing
-the Infisical fork entirely.
+the legacy Node.js fork entirely.
 
 ## Migration
 
@@ -17,7 +17,7 @@ the Infisical fork entirely.
 |---|---|
 | `ghcr.io/hanzoai/kms:*` | `ghcr.io/luxfi/kms:server` |
 | `github.com/hanzoai/kms` (Go import) | `github.com/luxfi/kms` |
-| `kms.hanzo.ai` (Infisical UI) | `api.kms.svc.cluster.local` (HTTP) |
+| `kms.hanzo.ai` (legacy web UI) | `api.kms.svc.cluster.local` (HTTP) |
 | In-cluster KMS HTTP | `kms.lux-kms-go.svc.cluster.local` |
 | In-cluster ZAP transport | `zap.kms.svc.cluster.local:9999` |
 
@@ -40,7 +40,7 @@ all, err := kms.GetSecrets(ctx)
 
 ## Why
 
-The Infisical fork (Node.js + PostgreSQL + Redis + complex web UI) was
+The legacy fork (Node.js + PostgreSQL + Redis + complex web UI) was
 incompatible with the "one and only one way" architectural principle.
 The Go-native implementation:
 

LLM.md

@@ -4,7 +4,7 @@
 **Repo**: github.com/hanzoai/kms
 **Module**: github.com/hanzoai/kms (Go 1.26.1)
 
-**Upstream lineage**: LICENSE attests Infisical (MIT) derivation. The Infisical-era code path was deleted; current request path is a thin wrapper over `github.com/luxfi/kms`. The copyright header is retained for legal accuracy, but no Infisical code remains on the wire.
+**Upstream lineage**: see `LICENSE` for the required upstream MIT attribution. The legacy fork's code path was deleted; the current request path is a thin wrapper over `github.com/luxfi/kms`. The copyright header is retained for legal accuracy, but none of the original upstream code remains on the wire.
 
 ## What this is
 
@@ -19,7 +19,7 @@ from luxfi/kms. This module owns three things:
 3. `pkg/kmsclient` — the Go client used by every other Hanzo service to
    fetch secrets at runtime (HTTP + ZAP fallback).
 
-There is **no Infisical** in this repo. There is **no Base/SQLite**. There
+There is **no legacy Node.js fork** in this repo. There is **no Base/SQLite**. There
 is **no PostgreSQL** in the canonical Go module. Everything that used to
 live in `internal/handler/`, `internal/store/`, `internal/server/` has been
 deleted in favour of the upstream `github.com/luxfi/kms/pkg/{store,keys,
@@ -248,7 +248,7 @@ resources (`secrets.lux.network/v1alpha1`) with:
 - `spec.hostAPI: http://kms.hanzo.svc.cluster.local/api`
 - `spec.authentication.universalAuth.secretsScope.{projectSlug,envSlug,secretsPath}`
 
-This shape was minted for the Infisical era. The current `kmsd` only
+This shape was minted for the legacy era. The current `kmsd` only
 serves `/v1/kms/*` and uses `org/secrets/{path}/{name}?env=…` — there is
 no `/api/v3/secrets/raw` and no `projectSlug`/`envSlug` model. The
 operator that reconciles `KMSSecret` resources must be updated to call
@@ -264,4 +264,4 @@ separately — this module does not touch the operator.
 - All secrets at rest are encrypted (envelope DEK + master key).
 - Passwords are never stored in this service. Identity lives in IAM.
   When IAM stores a password, it is bcrypt-hashed (cost ≥ 12).
-- No backwards compatibility. No env flags for "use Infisical instead."
+- No backwards compatibility. No env flags for "use the legacy backend instead."

NOTICE

@@ -0,0 +1,9 @@
+Hanzo KMS
+Copyright (c) 2025-2026 Hanzo AI, Inc.
+
+This product includes software derived from Infisical
+(https://github.com/Infisical/infisical), licensed under the MIT License,
+Copyright (c) 2022 Infisical Inc.
+
+The MIT License permission notice for the derived portions is retained in the
+LICENSE file of this repository, as required by that license.

frontend/src/App.tsx

@@ -112,7 +112,7 @@ export function App() {
           <Route path="/workspaces">
             <EndpointGap
               title="Workspaces"
-              description="Per-environment workspace shape (legacy Infisical terminology)."
+              description="Per-environment workspace shape (legacy KMS terminology)."
               endpoints={['GET /v1/kms/orgs/{org}/workspaces']}
               rationale="Workspaces are not a first-class concept on the canonical surface — environments are passed per-secret via ?env=. Kept here for migration tooling that maps legacy workspace IDs."
             />