docs: SECRETS.md — paths only; no secret values in this repo

SECRETS.md

@@ -0,0 +1,25 @@
+# Secrets — not stored in this repo
+
+Live passwords/keys live in sibling **`koopa-admin-secrets`** and on host/containers.
+
+## Map
+
+| What | Where (mirror) | Where (live) |
+|------|----------------|--------------|
+| Bank admin / explorer / exchange user passwords | `koopa-admin-secrets/koopa/host-root/taler-bank/*.txt` | `/root/bank-*-password.txt` on koopa |
+| Merchant instance password (goa-demo-…) | `…/taler-merchant/merchant-*-password.txt` | `/root/merchant-*-password.txt` |
+| Exchange `ATTRIBUTE_ENCRYPTION_KEY` | `…/containers/taler-exchange/secrets/exchange-attribute-encryption.secret.conf` | `/etc/taler-exchange/secrets/…` in exchange container |
+| Exchange wire gateway credentials | `…/containers/taler-exchange/secrets/exchange-accountcredentials-1.secret.conf` | same under container `/etc/taler-exchange/secrets/` |
+| Exchange / merchant / bank DB secrets | container `…/secrets/*-db.secret.conf` (if exported) | container `/etc/…/secrets/` |
+| Castopod / MariaDB passwords | host compose env (not mirrored here) | castopod stack env files |
+
+## Rules
+
+- **koopa-admin-log** may document *paths* and use `@inline-secret@` only.
+- Never commit password files, raw tokens, or `ATTRIBUTE_ENCRYPTION_KEY` hex.
+- Pull/deploy: `koopa-admin-secrets/scripts/{pull,deploy}-from-koopa.sh`.
+
+## Public (OK in this repo)
+
+- `MASTER_PUBLIC_KEY` / merchant `MASTER_KEY` (exchange master **public** key, also on `/keys`)
+- Port maps, unit ladders, non-secret overrides