rebrand: neutralize legacy upstream brand across UI, backend, docs; add NOTICE

Replace all inline references to the legacy upstream project with Lux KMS
branding (prose/labels), neutral identifiers (code), and neutral string
literals (frontend-internal cache keys, sentinels, masks), with every
reference renamed consistently so behavior is unchanged. Dead networking
UI (relay/gateway/pam) CLI examples now reference the Lux CLI.

Add a NOTICE file carrying the required upstream MIT attribution and full
permission notice — the only place the upstream name remains, as required
by that license.

No functional changes. Frontend (vite build) and Go backend
(go build -tags sqlite_fts5 sqlcipher) both build green.

.github/workflows/build-operator.yml

@@ -1,7 +1,7 @@
 name: Build KMS Operator
 
 # Builds the KMSSecret reconciler (cmd/kms-operator) over the native luxfi/zap
-# binary transport — replaces the legacy Infisical-flavor HTTP operator that
+# binary transport — replaces the legacy HTTP operator that
 # POSTed /api/v1/auth/universal-auth/login (which the Go KMS server does not
 # expose → 404, breaking every KMSSecret sync). Self-contained build (no
 # cross-org reusable workflow); same pattern as build-lux-kms.yml /