monitoring: resolve ladder explorer secret without laptop-hardcoded path

Ladder used /Users/newkamek/… for bank-explorer password and wallet-cli.
Use SECRETS_ROOT/read_secret, EXP_PW/EXP_PW_FILE overrides, and
find_wallet_cli. Document Android automation prereqs; stage shop assets
also require qrcode.min.js.

scripts/taler-monitoring/GIT-AUTOMATION-NOTES.md

@@ -0,0 +1,87 @@
+# Git / automation notes (taler-monitoring + mobile)
+
+Notes for **automated checks** around the Taler stacks (GOA, stage
+TESTPAYSAN, …). CLI monitoring lives in this directory; **Android wallet
+UI automation is separate tooling** and is **not** installed on the
+default ops laptop yet.
+
+## What runs without Android
+
+| Phase | Needs |
+|-------|--------|
+| `urls` / `sanity` | public HTTPS only |
+| `inside` / `versions` | SSH (`koopa` or `francpaysan-stage-user`) |
+| `e2e` / `ladder` | `taler-wallet-cli` + bank/merchant secrets |
+
+```bash
+./taler-monitoring.sh -d stage.lefrancpaysan.ch urls
+./taler-monitoring.sh -d stage.lefrancpaysan.ch e2e   # after secrets.env
+```
+
+Mobile app checks (manual withdraw/pay, then automation) are **out of
+band** until the software below is present.
+
+---
+
+## Android automation software — **required** (not installed yet)
+
+To automate **GNU Taler Wallet** on Android (stable + master builds;
+manual then auto withdraw; fixed + variable pay) against stage
+TESTPAYSAN, the following must be available on the runner host.
+
+### Status on this host (2026-07-17)
+
+| Component | Status |
+|-----------|--------|
+| Java (OpenJDK 21) | present (`/usr/bin/java`) |
+| `aapt` / `aapt2` | present |
+| **`adb`** (platform-tools) | **missing** (package was removed: `android-tools-adb` rc) |
+| **Android SDK** (`ANDROID_HOME` / `ANDROID_SDK_ROOT`) | **missing** / empty |
+| **Emulator + AVD** | **missing** |
+| Appium / Maestro / `uiautomator2` | **missing** |
+| scrcpy | missing (optional) |
+
+### Must install before mobile automation
+
+1. **Android platform-tools** — at least `adb`  
+   - Debian: `android-tools-adb` (and preferably full SDK platform-tools)
+2. **Android SDK command-line tools** — `sdkmanager`, platforms, build-tools  
+   - set `ANDROID_HOME` (or `ANDROID_SDK_ROOT`) permanently
+3. **System image + AVD** — for emulator runs (x86_64 or host-matching ABI)  
+   - `emulator`, `avdmanager`, KVM/acceleration if available
+4. **UI automation stack** (pick one, prefer the leaner path for wallet flows):  
+   - **Maestro**, or  
+   - **Appium** + **UiAutomator2** (+ Node/Python bindings as needed)
+5. **Optional:** `scrcpy` for live view during manual debugging
+
+### Explicitly out of scope until freigabe
+
+- Installing production wallet APKs and driving real stage withdraw/pay  
+  without a human go-ahead  
+- Committing secrets, device serials, or APK binaries into git
+
+### Operator still needs to supply
+
+- Stable / master **APK** (or store/build URLs) for the wallet  
+- USB debugging consent on a physical device, **or** agreement to use AVD only  
+- Which flows are in-scope first (withdraw communal QR → shop pay, …)
+
+### Suggested freigabe prompt (for an agent)
+
+See session notes: full copy-paste block under “Android-Automatisierung
+vollständig einrichten” — install tooling, verify `adb devices` + emulator,
+document paths; **no** real wallet payments until approved.
+
+---
+
+## Related docs
+
+| Doc | Role |
+|-----|------|
+| [README.md](./README.md) | how to run `taler-monitoring.sh` |
+| [TESTS.md](./TESTS.md) | grouped check IDs |
+| [secrets.env.example](./secrets.env.example) | e2e secrets layout |
+| `francpaysan-admin-log/TODO.md` | stage wallet mobile test backlog |
+
+When Android tooling is installed, append a short “installed on …”
+section here (date, `adb version`, AVD name, `ANDROID_HOME`).