fix(auth): KMS login proxies to the current IAM token endpoint

IAM moved its OAuth token endpoint to /v1/iam/oauth/token; the login proxy
(and the Go SDK client) still called the retired /v1/iam/login/oauth/access_token,
which now 404s — so /v1/kms/auth/login returned 401 for every valid machine
identity. This broke fresh KMSSecret-operator logins and the hanzoai/ci deploy-
cred fetch. Point both at /v1/iam/oauth/token (form/body unchanged); update LLM.md.

Note: requires a KMS image release + redeploy (ghcr.io/luxfi/kms) to take effect.

LLM.md

@@ -71,7 +71,7 @@ All routes live under `/v1/kms`. There is no `/api/`. There are no aliases.
 
 `POST /v1/kms/auth/login` exchanges `clientId`+`clientSecret` for an IAM
 access token by proxying to IAM's OAuth token endpoint
-(`POST $IAM_ENDPOINT/v1/iam/login/oauth/access_token`). The response is a
+(`POST $IAM_ENDPOINT/v1/iam/oauth/token`). The response is a
 plain `{accessToken, expiresIn, tokenType}` envelope. Outbound calls to
 IAM use `/v1/iam/*` — not a route this service exposes, and never
 `/api/*` (legacy Casdoor compat surface).

embed.go

@@ -495,7 +495,7 @@ func registerAuth(mux *http.ServeMux, iamEndpoint string) {
 			"client_id":     {req.ClientID},
 			"client_secret": {req.ClientSecret},
 		}
-		resp, err := iamClient.PostForm(iamEndpoint+"/v1/iam/login/oauth/access_token", form)
+		resp, err := iamClient.PostForm(iamEndpoint+"/v1/iam/oauth/token", form)
 		if err != nil {
 			writeJSON(w, http.StatusBadGateway, map[string]any{"statusCode": 502, "message": "identity provider unreachable"})
 			return

sdk/go/kmsclient/client.go

@@ -588,7 +588,7 @@ func (c *Client) getToken(ctx context.Context) (string, error) {
 		return c.accessToken, nil
 	}
 
-	tokenURL := c.iamEndpoint + "/v1/iam/login/oauth/access_token"
+	tokenURL := c.iamEndpoint + "/v1/iam/oauth/token"
 	form := url.Values{
 		"grant_type":    {"client_credentials"},
 		"client_id":     {c.clientID},