Migrate off deprecated keycloak::login::password_url to token_url

[scolear]

Summary

The codebase still calls the deprecated keycloak::login::password_url for building the Keycloak token endpoint. It was deprecated in canton-lib (since 0.5.1) in favor of token_url(host, realm); for the legacy /auth context-root layout you pass {host}/auth as the host. Migrating clears the #[warn(deprecated)] warnings and aligns with the current canton-lib API.

Reference implementation

examples/allocate_cbtc.rs (added in #59) already uses the migrated form:

url: keycloak::login::token_url(
    &format!("{}/auth", env::var("KEYCLOAK_HOST").expect("KEYCLOAK_HOST must be set")),
    &env::var("KEYCLOAK_REALM").expect("KEYCLOAK_REALM must be set"),
),

This is behavior-preserving: token_url("{host}/auth", realm) produces the exact same URL as the old password_url(host, realm) ({host}/auth/realms/{realm}/protocol/openid-connect/token), since the CBTC Keycloak uses the legacy /auth layout.

Scope

All remaining password_url call sites — examples and the #[cfg(test)] auth in src/:

grep -rl password_url examples/ src/

(~19 examples plus src/{batch,distribute,consolidate,credentials,active_contracts,transfer,split}.rs and src/mint_redeem/{mint,redeem}.rs.) If password_master_url is used anywhere, migrate it to master_token_url the same way.

Context

Noted in #59 (the allocation client PR), which migrated only its own new example and left the rest for a focused follow-up.