docs: rename diagram assets to doc-prefixed scheme, update exports

Asset renames (matching the new Nextcloud source naming convention —
doc name first, then description):
- architecture-trust-depth.svg -> architecture-overview-trust-depth.svg
- firewall-docker-bypass.svg -> firewall-and-network-docker-bypass.svg
- secrets-lifecycle.svg -> secrets-and-pki-lifecycle.svg
- trust-boundaries-blast-radius.svg -> readme-trust-boundaries-blast-radius.svg
Updated all 4 markdown references accordingly.

Also refreshed diagram exports (secret-distribution-flows.svg, and the
4 renamed ones) with today's fixes, and folded in the earlier pending
sso-and-identity.md work: precise live-verified native-OIDC app list
(12 apps, not ~9), the Proxmox no-Proxy-Provider exception, real API
evidence for it, and the automation-bot migration story.

docs/architecture-overview.md

@@ -18,7 +18,7 @@ The easy answers are both wrong. **One boundary** ("you're on the LAN, you're tr
 
 The actual answer here is **four boundaries, each doing a different job**:
 
-![Trust depth: two independent entry paths converge on backend services, which still enforce their own internal boundaries](../assets/architecture-trust-depth.svg)
+![Trust depth: two independent entry paths converge on backend services, which still enforce their own internal boundaries](../assets/architecture-overview-trust-depth.svg)
 
 | Boundary | Who's on the other end | Control | Why this control, not another |
 |---|---|---|---|