docs: add architecture, IaC pipeline, and disaster recovery write-ups

Completes the docs/ set - all 16 systems now have a full deep-dive
page in the diagram+callout+table style. Architecture overview covers
the 4 trust boundaries and 2 traffic planes; IaC pipeline is a fresh
Packer->Terraform->Ansible writeup replacing the stale old-content/
snapshot; disaster recovery covers the 3 independent backup layers
and the deliberately decoupled OS/app upgrade systems.

docs/architecture-overview.md

@@ -0,0 +1,82 @@
+# 📐 Architecture Overview
+
+> [!NOTE]
+> The stable, directional laws governing how traffic moves through the fleet — re-verified against live infrastructure, not assumed from older documentation. Two real corrections were caught and fixed the last time this was checked, which is exactly the point of re-verifying rather than trusting a prior write-up forever.
+
+## Dependency graph
+
+```mermaid
+flowchart TD
+    Internet(["Internet"]) --> Edge["Edge Firewall<br/>NAT · public reverse proxy · NTP · DHCP"]
+    Edge --> LAN["LAN"]
+
+    LAN --> DNS["Internal DNS"]
+    LAN --> Vault["Vault"]
+    DNS --> Vault
+
+    Vault --> Apps["App Host<br/>~40 stacks"]
+    LAN --> FileServer["File Server"]
+    DNS --> FileServer
+    Vault --> Automation["Automation Host"]
+    LAN --> Automation
+
+    Apps --> InternalProxy["Internal reverse-proxy zone"]
+    Apps --> SSO["SSO"]
+
+    Automation --> Gitea["Git hosting<br/>internal + public mirror"]
+
+    Vault --> EdgeProxy["User-facing reverse proxy<br/>mTLS"]
+    DNS --> EdgeProxy
+    Apps -.proxied by.-> EdgeProxy
+    SSO -.auth gate via.-> EdgeProxy
+
+    Apps -.reports to.-> Monitoring["Monitoring"]
+    Automation -.reports to.-> Monitoring
+    FileServer -.reports to.-> Monitoring
+    EdgeProxy -.reports to.-> Monitoring
+    Vault -.reports to.-> Monitoring
+    DNS -.reports to.-> Monitoring
+
+    Apps -.reports to.-> Wazuh["Security Monitoring"]
+    Automation -.reports to.-> Wazuh
+    FileServer -.reports to.-> Wazuh
+    EdgeProxy -.reports to.-> Wazuh
+    Vault -.reports to.-> Wazuh
+    DNS -.reports to.-> Wazuh
+```
+
+## Four trust boundaries, not two
+
+```mermaid
+flowchart LR
+    WAN["WAN"] -->|public application boundary| EdgeFW["Edge Firewall / public proxy"]
+    Browser["LAN browsers"] -->|mTLS + SSO| UserProxy["User-facing proxy"]
+    Service["App-to-app"] -->|IP-allowlist + SSO| InternalProxy["Internal proxy"]
+    Infra["LAN infra-to-infra"] -->|explicit per-flow rules| HostFW["Host firewall rules"]
+```
+
+Backend services trust proxy headers, not raw client IP, on every path.
+
+## Two structurally independent traffic planes
+
+| Plane | Path |
+|---|---|
+| **Ingress — public** | Client → edge firewall/proxy → backend |
+| **Ingress — LAN-facing** | Client → user-facing proxy (mTLS) → backend |
+| **East-west — app-to-app** | Service → internal proxy zone → service |
+| **East-west — infra-to-infra** | Service → firewall rule → service, direct, no proxy |
+
+> [!IMPORTANT]
+> **Observability sits outside every request path on purpose.** Logs and metrics push asynchronously to monitoring infrastructure; nothing in that pipeline is inline with application traffic, and application services don't depend on monitoring availability. If monitoring goes down, collection stops — nothing else does.
+
+## Caught by re-verification, not assumed
+
+> [!WARNING]
+> The last full re-check against live infrastructure found two real corrections to what was previously documented: the public reverse-proxy layer had actually moved from running as its own dedicated VM to running as a package directly on the edge firewall — and an older "flat mesh network, no mutual TLS" model for internal service traffic had been fully replaced by the two-zone split described in [`docs/dns-naming.md`](dns-naming.md), without the architecture documentation being updated to match at the time. Both were caught by running real commands against the live fleet, not by re-reading the previous version and assuming it still held.
+
+## What this map deliberately excludes
+
+Not a firewall rule listing, not a port inventory, not a service configuration reference — those live in their own docs ([`docs/firewall-and-network.md`](firewall-and-network.md) and elsewhere). This is strictly the stable, directional shape of how trust and traffic actually move.
+
+---
+Related: [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/dns-naming.md`](dns-naming.md)