Avoids the well-known /login path that scanners hit by default. The cm- prefix matches the rest of the project's namespacing (cm-web-next, cm-api, etc.) and isn't on standard scanner wordlists. Settings page moves to flat /cm-passkeys (was /settings/passkeys) to drop the simple 'settings' word — same scanner-noise reasoning. File paths follow: web/app/cm-auth/, web/app/cm-passkeys/.