docs+config: exchange-overrides.conf like merchant; drop zz- files

configs/taler-exchange/README.md

@@ -1,3 +1,38 @@
-# taler-exchange
+# Exchange (GOA) site notes
 
-Separate container tried; reverted — conf.d only.
+Container: **`taler-exchange-hacktivism`** · image tags `localhost/taler-exchange-hacktivism-live:9011` (live) and optional snapshot  
+Host port: **9011** (pasta) · public: **https://exchange.hacktivism.ch/** (Caddy → 9011)
+
+**Snapshot + restore (local tar, no registry):**  
+→ [`2026/2026-07-09--exchange-snapshot-and-restore.md`](../../2026/2026-07-09--exchange-snapshot-and-restore.md)
+
+## Terms of service (wallets)
+
+Wallets require a working `/terms` (and usually `/privacy`) with a
+`Taler-Terms-Version` header. If missing, many apps hang on accept /
+`isPending` during the first withdraw QR.
+
+This site uses **minimal stubs** — no formal legal ToS:
+
+| Config | Value |
+|--------|--------|
+| `TERMS_ETAG` | `no-terms-v0` |
+| `PRIVACY_ETAG` | `no-privacy-v0` |
+| files | `/var/lib/taler-exchange/terms/en/no-terms-v0.{html,txt,md}` etc. |
+
+Install / refresh inside the exchange container as root:
+
+```bash
+/usr/local/bin/install_no_terms.sh
+# ensure exchange-overrides.conf has TERMS_ETAG / PRIVACY_ETAG (see above)
+runuser -u taler-exchange-httpd -- /usr/local/bin/start_exchange.sh --restart
+curl -sS -D- http://127.0.0.1:9011/terms | head
+```
+
+Sources: `configs/taler-exchange/terms-src/` and
+`scripts/taler-exchange/install_no_terms.sh`.
+
+## Secrets
+
+`ATTRIBUTE_ENCRYPTION_KEY` and wire/DB credentials are **not** in this tree.  
+See repo-root `SECRETS.md` and `koopa-admin-secrets/containers/taler-exchange/secrets/`.