docs: describe current state only, and fill in the stub READMEs

Drop the history and roadmap asides: which services predate the collection's
conventions, the unwired Open Web UI plan, the generic clone-and-troubleshoot
boilerplate. Services that publish ports or set `restart:` now simply say so.

couchbase, openvpn-as and traffmonetizer had two-line READMEs; give them the
ports, variables and storage the root README promises. traffmonetizer reads
${TOKEN} and had no .env.example, so add one.

paseo/.env.example

@@ -2,8 +2,8 @@
 #
 #   cp .env.example .env
 
-# Password for the daemon API and web UI. Doubles as the paseo user's login
-# password, so it is also what `sudo` asks for inside a terminal.
+# Password for the daemon API and web UI. Also the paseo user's login password,
+# so it is what `sudo` asks for inside a terminal.
 # Generate one with: openssl rand -base64 24
 PASEO_PASSWORD=
 
@@ -11,27 +11,24 @@ PASEO_PASSWORD=
 # Coolify/Dokploy must be listed here. IPs and localhost are always allowed.
 PASEO_HOSTNAMES=
 
-# Proxy addresses whose X-Forwarded-Proto the daemon trusts. Without this the
-# daemon only trusts loopback, so behind Coolify/Dokploy it sees plain HTTP,
-# tells the web UI the connection is not TLS, and the UI falls back to trying
-# ws://...:6767 from an HTTPS page -- which the browser blocks.
+# Proxy source IPs whose X-Forwarded-Proto the daemon trusts. Without this it
+# trusts loopback only, reads the request as plain HTTP behind Coolify/Dokploy,
+# and tells the web UI to open ws:// from an HTTPS page -- which browsers block.
 # `uniquelocal` covers the private ranges Docker bridge networks use.
 PASEO_TRUSTED_PROXIES=uniquelocal
 
-# Container hostname. Paseo shows it as the host label in the web UI, so
-# without it you get a random container ID.
+# Container hostname, shown as the host label in the web UI. Without it the
+# label is a random container ID.
 PASEO_LABEL=paseo
 
 # Timezone for logs and agent shells.
 TZ=Asia/Ho_Chi_Minh
 
-# Git identity for agents and terminals, as author and committer. These reach
-# git as environment variables, so they need no `git config` and survive a
-# rebuild -- unlike a ~/.gitconfig, which only lives in the /home/paseo volume.
+# Git identity for agents and terminals, as author and committer. git reads
+# these directly, so no `git config` step is needed.
 GIT_NAME=tiennm99
 GIT_EMAIL=tiennm99@outlook.com
 
-# Shell for Paseo's terminals. Paseo reads $SHELL and falls back to /bin/sh
-# (dash), ignoring the user's login shell, so set it here rather than running
-# chsh -- which would be reverted by the next rebuild anyway.
+# Shell for Paseo's terminals. Paseo reads $SHELL and otherwise falls back to
+# /bin/sh (dash); it ignores the user's login shell, so `chsh` has no effect.
 SHELL=/bin/zsh