architecture-overview: tighten two image captions that undersold their own screenshots

Both captions described only one rule visible in a multi-rule screenshot,
technically accurate but misleading about what the image actually shows.

docs/architecture-overview.md

@@ -58,7 +58,7 @@ That third fix isn't just a claim — it's the actual live ruleset:
 
 ![pfSense LAN catch-all deny rule: block+log east-west traffic not explicitly allowed](../assets/pfsense-rules-lan-catchall-deny.png)
 
-![pfSense rule explicitly allowing LAN to WAN/internet only, not LAN-to-LAN](../assets/pfsense-rules-lan-core-services.png)
+![pfSense's core LAN service rules, including the explicit rule allowing LAN to WAN/internet only, never LAN-to-LAN](../assets/pfsense-rules-lan-core-services.png)
 
 <details>
 <summary>See the rest of the actual pfSense configuration</summary>
@@ -71,9 +71,9 @@ That third fix isn't just a claim — it's the actual live ruleset:
 
 ![pfSense LAN rules for Alloy metrics, MQTT, Wazuh agent reporting, NTP](../assets/pfsense-rules-lan-observability.png)
 
-**LAN — the Ansible SSH fan-out, one explicit rule per host, sourced from the automation host only:**
+**LAN — the Ansible SSH fan-out (one explicit rule per host, sourced from the automation host only), plus the application-integration rules sitting right below it:**
 
-![pfSense LAN rules showing per-host Ansible SSH fan-out rules](../assets/pfsense-rules-lan-ssh-fanout.png)
+![pfSense LAN rules showing per-host Ansible SSH fan-out rules and application integration rules](../assets/pfsense-rules-lan-ssh-fanout.png)
 
 **LAN — the built-in anti-lockout rule, at the top of the list by necessity:**