Legal + release-readiness pass for Hash Bags launch

Legal (aligned with the hosted hash.boats Terms & Privacy):
- Rewrite in-app Terms (assets/text/Terms_of_Use.txt): drop the false 'No Fiat
  Operations'/'No Embedded Applications' clauses; add MoonPay (optional, where
  available), Trocador swaps + ~1% fee disclosure, WalletConnect, sanctions/18+,
  Apple EULA rider, and PA + class/jury-waiver dispute terms.
- Reconcile PRIVACY.md with the canonical hosted policy.
- Add THIRD_PARTY_LICENSES.md; correct the blanket 'MIT' claim in README (app
  code MIT; bundles BSD-3/Apache-2.0/LGPL-3.0); fix README build-doc + LICENSE.md
  links and copyright year.
- Standardize in-app legal naming to 'Terms of Service'; add in-app links to
  hash.boats/terms and /privacy.

Release fixes:
- Align URL scheme hashwallet:// -> hashbags:// (matches registered scheme) so
  WalletConnect/Trezor/quick-action deep links work.
- Store-review gating: hide Buy action until a provider is available; hide the
  empty 'Apps' tab.
- Exclude removed chains (SOL/TRX/ZEC/DCR/ZANO + tokens) from swap pickers.
- Residual Cake branding: macOS CFBundleDisplayName and Windows Runner.rc
  (Hash Wallet -> Hash Bags); remove Android cakewallet://y.at leftover.
- Genericize internal-infra comments in CI workflows.

.github/workflows/build-ios-sim.yml

@@ -32,11 +32,10 @@ jobs:
       # Gitea runner shell). Force UTF-8 globally so `pod install` succeeds.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
-      # If you added an /etc/hosts entry on the Mac mini that points
-      # git.such.software at NPM's LAN IP (so the runner hits NPM's
-      # Let's Encrypt cert instead of Gitea's internal self-signed),
-      # this env var can be removed. Left in as a belt-and-suspenders
-      # fallback — has no effect if certs already verify.
+      # Belt-and-suspenders fallback for when the self-hosted runner's internal
+      # git host presents a self-signed cert. Preferred fix is to trust the
+      # internal CA on the runner, after which this can be removed. (Runner
+      # host and network specifics live in the internal CI docs, not this repo.)
       NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:

.github/workflows/build-windows.yml

@@ -36,8 +36,9 @@ jobs:
     runs-on: windows
     env:
       BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-      # Belt-and-suspenders: bypass Node TLS verification for actions/* that
-      # talk back to git.such.software. Same fallback as build-ios-sim.yml.
+      # Belt-and-suspenders fallback that bypasses Node TLS verification for
+      # actions/* against the self-hosted runner's internal git host. Same
+      # fallback as build-ios-sim.yml.
       NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps: