README: rebuild full diagram with corrected edge direction

Restructured so the edge proxy feeds forward into the app host
(EdgeProxy -.proxies.-> Apps) instead of the app host and SSO
pointing backward into the proxy - matches the real traffic
direction (browser hits the proxy first, which routes to the app)
and removes the long rank-spanning edges that were likely behind the
rendering gap. Full node set restored, colors restored.

README.md

@@ -85,9 +85,29 @@ flowchart LR
     LAN --> Vault["Vault<br/>PKI + secrets"]
     DNS --> Vault
 
+    LAN --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
+    Vault --> EdgeProxy
+    DNS --> EdgeProxy
+
     Vault --> Apps["App Host<br/>41 stacks"]
     Vault --> Automation["Automation VM<br/>Git + orchestration"]
     LAN --> FileServer["File Server"]
+    DNS --> FileServer
+    LAN --> Automation
+
+    EdgeProxy -.proxies.-> Apps
+    Apps --> InternalProxy["Internal Proxy Zone"]
+    Apps -.auth.-> SSO["SSO"]
+
+    Automation -.-> Monitoring["Monitoring"]
+    Automation -.-> SecMon["Security Monitoring"]
+
+    classDef edge fill:#f8cecc,stroke:#b85450,color:#333
+    classDef core fill:#dae8fc,stroke:#6c8ebf,color:#333
+    classDef obs fill:#fff2cc,stroke:#d6b656,color:#333
+    class Internet,Edge edge
+    class LAN,DNS,Vault,Apps,Automation,FileServer,InternalProxy,SSO,EdgeProxy core
+    class Monitoring,SecMon obs
 ```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).