rip: migrate KMS universal-auth login to canonical /v1/kms/auth/login

hanzo-kms (sync + async): /api/v1/auth/universal-auth/login →
/v1/kms/auth/login. Body already canonical {clientId,clientSecret};
TokenResponse already parses {accessToken,expiresIn,tokenType}.

Scoped per CTO ruling: ONLY endpoints with a real canonical /v1/kms/*
target are migrated. The remaining /api/v3/secrets/raw/*,
/api/v1/auth/{kubernetes-auth,aws-auth}/login and /api/v3/auth/login
have NO canonical route (or a different API shape) on the kms.hanzo.ai
server and are left intact — rewriting them would mint dead /v1 paths.
They are flagged for a separate SDK-port task. Clean break, no aliases
(org rule: one way, /v1/, never /api/).

Co-authored-by: Hanzo Dev <[email protected]>

pkg/hanzo-kms/hanzo_kms/async_client.py

@@ -90,7 +90,7 @@ class AsyncKMSClient:
         # Universal Auth
         if auth.universal_auth:
             response = await self.http.post(
-                "/api/v1/auth/universal-auth/login",
+                "/v1/kms/auth/login",
                 json={
                     "clientId": auth.universal_auth.client_id,
                     "clientSecret": auth.universal_auth.client_secret,

pkg/hanzo-kms/hanzo_kms/client.py

@@ -149,7 +149,7 @@ class KMSClient:
         # Universal Auth
         if auth.universal_auth:
             response = self.http.post(
-                "/api/v1/auth/universal-auth/login",
+                "/v1/kms/auth/login",
                 json={
                     "clientId": auth.universal_auth.client_id,
                     "clientSecret": auth.universal_auth.client_secret,