fix(auth): wire Microsoft SSO launch

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

nginx.conf

@@ -27,6 +27,28 @@ server {
   # way it does from the public internet.
   resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
 
+  # Microsoft SSO is implemented by auth-service, but the demo API
+  # gateway currently does not expose /api/v1/auth/microsoft/*. Keep the
+  # FlowMaster/fm-shell contract same-origin by routing this one auth
+  # surface directly to auth-service; the callback keeps X-Forwarded-Host
+  # so auth-service returns to https://canvas.flow-master.ai/auth/sso-callback#...
+  location ^~ /api/v1/auth/microsoft/ {
+    # Use the Kubernetes ClusterIP directly. The server-wide resolver is
+    # deliberately pinned to public DNS for external demo/dev hostnames,
+    # and public DNS resolves *.svc.cluster.local to the node wildcard,
+    # not the in-cluster Service.
+    proxy_pass http://10.43.128.185:9001;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Proto https;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_http_version 1.1;
+    proxy_connect_timeout 8s;
+    proxy_send_timeout 30s;
+    proxy_read_timeout 30s;
+    proxy_buffering off;
+  }
+
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
   # Uses $variable form so nginx queries the PUBLIC resolver above per
   # request (cached 5 minutes). Combined with proxy_next_upstream this