auth: align all SDK packages to canonical <org>-<app> client ids

IAM seeds apps as <org>-<app> (iam cmd/iam/cli/init_apps.go:57-59):
hanzo-app, zoo-app, lux-app — AppName == ClientID. Several packages used the
inverted 'app-hanzo'/'app-hanzobot' or placeholder '*-client-id', none of which
IAM knows — device/PKCE login would fail. One value, everywhere:

- hanzoai/auth.py: login_with_pkce default -> IAM_CLIENT_ID (hanzo-app)
- hanzo-cli/auth.py: DEFAULT_APP, DEFAULT_CLIENT_ID -> hanzo-app
- hanzo/commands/auth.py: IAM_CLIENT_ID -> hanzo-app
- hanzo-tools-auth/session.py: DEFAULT_APP, DEFAULT_CLIENT_ID -> hanzo-app
- hanzo/commands/iam.py: --app default + doc example -> hanzo-app
- hanzo-cli/bot/commands.py: BOT_IAM_APP/CLIENT_ID app-hanzobot -> hanzo-bot

pkg/hanzo-cli/hanzo_cli/auth.py

@@ -27,8 +27,8 @@ TOKEN_FILE = TOKEN_DIR / "token.json"
 
 DEFAULT_IAM_URL = "https://hanzo.id"
 DEFAULT_ORG = "hanzo"
-DEFAULT_APP = "app-hanzo"
-DEFAULT_CLIENT_ID = "hanzo-app-client-id"
+DEFAULT_APP = "hanzo-app"
+DEFAULT_CLIENT_ID = "hanzo-app"
 CALLBACK_PORT = 8399
 CALLBACK_PATH = "/callback"
 

pkg/hanzo-cli/hanzo_cli/bot/commands.py

@@ -42,10 +42,10 @@ BOT_LOG_FILE = Path.home() / ".hanzo" / "bot" / "node.log"
 DEFAULT_GATEWAY_HOST = "gw.hanzo.bot"
 DEFAULT_GATEWAY_PORT = 443
 NPM_PACKAGE = "@hanzo/bot"
-BOT_IAM_CLIENT_ID = "hanzobot-client-id"
+BOT_IAM_CLIENT_ID = "hanzo-bot"
 BOT_IAM_SERVER_URL = "https://hanzo.id"
 BOT_IAM_ORG = "hanzo"
-BOT_IAM_APP = "app-hanzobot"
+BOT_IAM_APP = "hanzo-bot"
 BOT_CALLBACK_PORT = 8398
 BOT_CALLBACK_PATH = "/callback"
 BOT_TOKEN_FILE = Path.home() / ".hanzo" / "bot" / "token.json"
@@ -577,9 +577,9 @@ class _BotOAuthCallbackHandler(http.server.BaseHTTPRequestHandler):
 def _bot_browser_login() -> str:
     """Run browser OAuth login flow for the bot gateway.
 
-    Opens the user's browser to the IAM login page (hanzobot application),
+    Opens the user's browser to the IAM login page (hanzo-bot application),
     starts a local HTTP server to receive the callback, exchanges the code
-    for tokens scoped to hanzobot-client-id.
+    for tokens scoped to the hanzo-bot client.
 
     Returns:
         Access token string.
@@ -672,7 +672,7 @@ def _bot_browser_login() -> str:
 def _bot_password_login(
     username: str | None = None, password: str | None = None
 ) -> str:
-    """Login via password grant using the hanzobot client. Returns access_token."""
+    """Login via password grant using the hanzo-bot client. Returns access_token."""
     import time
 
     import httpx
@@ -730,7 +730,7 @@ def _get_iam_token() -> str:
     if token:
         return token
 
-    # Try stored bot-specific token (issued by hanzobot-client-id)
+    # Try stored bot-specific token (issued by the hanzo-bot client)
     bot_data = _load_bot_token()
     if bot_data and bot_data.get("access_token"):
         return bot_data["access_token"]

pkg/hanzo-tools-auth/hanzo_tools/auth/session.py

@@ -26,8 +26,8 @@ TOKEN_FILE = TOKEN_DIR / "token.json"
 # IAM defaults (same as hanzo-cli)
 DEFAULT_IAM_URL = "https://hanzo.id"
 DEFAULT_ORG = "hanzo"
-DEFAULT_APP = "app-hanzo"
-DEFAULT_CLIENT_ID = "hanzo-app-client-id"
+DEFAULT_APP = "hanzo-app"
+DEFAULT_CLIENT_ID = "hanzo-app"
 
 
 def _env(name: str) -> str:

pkg/hanzo/src/hanzo/commands/auth.py

@@ -20,7 +20,7 @@ from ..utils.output import console
 
 # OAuth constants
 IAM_URL = "https://hanzo.id"
-IAM_CLIENT_ID = "app-hanzo"
+IAM_CLIENT_ID = "hanzo-app"
 CALLBACK_PORT = 1456
 CALLBACK_PATH = "/callback"
 CALLBACK_URI = f"http://localhost:{CALLBACK_PORT}{CALLBACK_PATH}"

pkg/hanzo/src/hanzo/commands/iam.py

@@ -1120,7 +1120,7 @@ def enforce_hashing(org: str, algorithm: str, all_orgs: bool):
 @click.option("--username", "-u", help="Username or email")
 @click.option("--password", "-p", help="Password")
 @click.option("--org", "-o", default="hanzo", help="Organization")
-@click.option("--app", "-a", default="app-hanzo", help="Application name")
+@click.option("--app", "-a", default="hanzo-app", help="Application name")
 def iam_login(username: str, password: str, org: str, app: str):
     """Login as a user via IAM (email/password).
 
@@ -1237,7 +1237,7 @@ def iam_api(endpoint: str, method: str, body: str, param: tuple):
     \b
     Examples:
       hanzo iam api /api/get-users --param owner=hanzo
-      hanzo iam api /api/get-application --param id=hanzo/app-hanzo
+      hanzo iam api /api/get-application --param id=hanzo/hanzo-app
       hanzo iam api /api/get-providers --param owner=admin
     """
     extra_params = {}

pkg/hanzoai/auth.py

@@ -429,7 +429,7 @@ class HanzoAuth:
         self,
         authorize_url: Optional[str] = None,
         token_url: Optional[str] = None,
-        client_id: str = "app-hanzo",
+        client_id: str = IAM_CLIENT_ID,
         scopes: Optional[List[str]] = None,
         redirect_port: int = 4545,
     ) -> OAuthTokenSet: