docs: add Docker/firewalld bypass diagram to firewall-and-network.md

Visualizes the documented gap: pfSense always applies, firewalld only
covers native services, Docker-published ports skip straight past it.

docs/firewall-and-network.md

@@ -62,6 +62,8 @@ rule family="ipv4" source address="[automation host]" port port="[this host's SS
 > [!WARNING]
 > **A real, documented gap**: on Docker hosts, container-published ports bypass firewalld entirely — Docker's own iptables rules are evaluated before firewalld's zone rules, so firewalld's local restrictions only actually protect the small number of *native*, non-containerized services on that host (things like the observability agent from [`docs/observability.md`](observability.md)), not the dozens of containerized apps in [`stacks/`](../stacks/). The network-level segmentation above still applies regardless — pfSense doesn't care whether a port is opened by firewalld or by Docker's own NAT rules — so this is a defense-in-depth gap specifically at the host layer, not an open-to-the-world one. Worth naming precisely rather than glossing over: firewalld protects less of a Docker host's actual attack surface than it might first appear to.
 
+![Two enforcement layers per packet — pfSense always applies, firewalld only catches native services, Docker-published ports skip straight past it](../assets/firewall-docker-bypass.svg)
+
 ## Edge firewall: three jobs, one device
 
 One device, three distinct responsibilities, not three separate boxes: