Rename the authz surface to "exchange" (siwe + exchange)

[elffjs]

What

Names the two surfaces for the actions they perform — /siwe (sign-in) and /exchange — replacing the lingering "token exchange" package/identifier verbiage. This also finally aligns the internal name with the shipped gRPC TokenExchangeService.

The one distinction that drives the whole diff

There were two sacds doing different jobs, and they go opposite directions:

• exchange = the surface → renamed everywhere
• SACD = the on-chain access-control primitive → stays exactly as-is

A blanket find/replace would have corrupted real contract code; this PR carefully preserves the domain term.

Surface → exchange (packages, URL, env, secrets, docs)

• internal/tokenexchange/ → internal/exchange/ (all import paths)
• Public route → /exchange, which drives the issuer (iss == the URL the discovery doc is served from): EXCHANGE_ISSUER=https://dauth.dimo.zone/exchange
• Env vars → EXCHANGE_ISSUER / EXCHANGE_SIGNING_KEY_*
• AWS secret path → <ns>/exchange/signing_key_1
• ExchangeController, exchange*.go, swagger basePath, README, charts, dockerfile, run-local, local keyfile

SACD-the-domain — unchanged

contracts/sacd, sacdproxy, models.SACDData, SACDInterface, autheval's sacd* maps, GetValidSacdDoc, TypeSACD, CONTRACT_ADDRESS_SACD, and every "on-chain SACD access check". The permissions claim and the "permission token" artifact name are part of the token contract and are likewise untouched.

Kept frozen

The gRPC contract consumers depend on — TokenExchangeService, pkg/grpc/token-exchange-api.*, TokenExchangeServer, ServiceName — which already carries the "exchange" term.

Deploy follow-ups (flag-day, consumer-owned)

• Consumers repoint to …/exchange/keys and iss https://dauth.dimo.zone/exchange (telemetry/dq/fetch auth0 validators pin that iss).
• Provision the AWS secret at the new path <ns>/exchange/signing_key_1.

Verification

Build, vet, gofmt, full test suite, and helm lint (dev + prod) all pass.

🤖 Generated with Claude Code