fix(zoo-exchange): point KMSSecret at Lux KMS, not legacy Hanzo KMS

* apiVersion was wrong: kms.hanzo.ai/v1alpha1 doesn't exist in cluster.
  Real CRD is secrets.lux.network/v1alpha1, owned by ghcr.io/luxfi/kms-operator.
* hostAPI added (required field) → kms.lux-kms.svc.cluster.local
  (~/work/lux/kms Go-native server, MPC-backed via ~/work/lux/mpc).
* Project slug zoo-exchange (own project), env prod, path /.
  No more shared hanzo-exchange/zoo subpath.
* Resource named zoo-exchange-kms-sync to match the *-kms-sync naming
  convention used by analytics/billing/cloud/etc. across hanzo namespace.

k8s/zoo-exchange/deployment.yaml

@@ -1,33 +1,39 @@
 ---
 # zoo.exchange — hanzoai/spa serving the @luxfi/exchange SPA bundle.
 #
-# Secrets ALL come from Hanzo KMS via KMSSecret CRD.
+# Secrets come from Lux KMS (~/work/lux/kms — Go-native, MPC-backed).
+# Operator `ghcr.io/luxfi/kms-operator` reconciles KMSSecret CRDs
+# (`secrets.lux.network/v1alpha1`) by pulling from Lux KMS at
+# `kms.lux-kms.svc.cluster.local` and writing K8s Secrets that pods consume.
+#
 # DNS:  zoo.exchange / www.zoo.exchange / exchange.zoo.network / trade.zoo.exchange  →
 #       lux-k8s LB 134.199.138.27 → ingress → this Service.
-# Per-org Insights API key lives at KMS path  /zoo  in the  hanzo-exchange  project.
-# Public chain RPC + bridge endpoints come from the SPA brand config (/config.json),
-# which is templated by the hanzoai/spa runtime from the SPA_* env vars below.
-apiVersion: kms.hanzo.ai/v1alpha1
+apiVersion: secrets.lux.network/v1alpha1
 kind: KMSSecret
 metadata:
-  name: zoo-exchange
+  name: zoo-exchange-kms-sync
   namespace: zoo
+  labels:
+    app: zoo-exchange
+    brand: zoo
+    app.kubernetes.io/managed-by: hanzo-universe
 spec:
+  hostAPI: http://kms.lux-kms.svc.cluster.local
+  resyncInterval: 60
   authentication:
     universalAuth:
       credentialsRef:
-        secretName: kms-zoo-exchange-credentials
+        secretName: universal-auth-credentials
         secretNamespace: zoo
+      secretsScope:
+        envSlug: prod
+        projectSlug: zoo-exchange
+        secretsPath: /
   managedSecretReference:
+    creationPolicy: Orphan
     secretName: zoo-exchange-secrets
     secretNamespace: zoo
     secretType: Opaque
-  resyncInterval: 60
-  secretsScope:
-    projectSlug: hanzo-exchange
-    environmentSlug: prod
-    secretsPath: /zoo
-    recursive: false
 ---
 apiVersion: apps/v1
 kind: Deployment