README: replace Mermaid diagram with real drawio SVG export

No more Mermaid, per standing rule - the architecture diagram is now
a real image (assets/architecture-overview.svg), built and exported
from the Nextcloud Diagramming app, fetched via WebDAV and validated
as well-formed XML before committing. Ends the rendering-gap chase
entirely since there's no live renderer involved anymore, just a
static image.

README.md

@@ -76,46 +76,7 @@ This repo is a sanitized showcase of the systems behind that platform — the ac
 
 ## Architecture at a glance
 
-```mermaid
+![Architecture Overview](assets/architecture-overview.svg)
-flowchart LR
-    Internet(["Internet"]) --> Edge["Edge Firewall"]
-    Edge --> LAN["LAN"]
-
-    LAN --> DNS["Internal DNS<br/>two zones"]
-    LAN --> Vault["Vault<br/>PKI + secrets"]
-    DNS --> Vault
-
-    Vault --> Apps["App Host<br/>41 stacks"]
-    Vault --> Automation["Automation VM<br/>Git + orchestration"]
-    LAN --> FileServer["File Server"]
-    DNS --> FileServer
-    LAN --> Automation
-
-    Apps --> InternalProxy["Internal Proxy Zone"]
-    Apps --> SSO["SSO"]
-
-    Vault --> EdgeProxy["User-Facing Proxy<br/>mTLS"]
-    DNS --> EdgeProxy
-    Apps -.proxied.-> EdgeProxy
-    SSO -.auth.-> EdgeProxy
-
-    Apps -.-> Monitoring["Monitoring"]
-    Automation -.-> Monitoring
-    FileServer -.-> Monitoring
-    EdgeProxy -.-> Monitoring
-
-    Apps -.-> SecMon["Security Monitoring"]
-    Automation -.-> SecMon
-    FileServer -.-> SecMon
-    EdgeProxy -.-> SecMon
-
-    classDef edge fill:#f8cecc,stroke:#b85450,color:#333
-    classDef core fill:#dae8fc,stroke:#6c8ebf,color:#333
-    classDef obs fill:#fff2cc,stroke:#d6b656,color:#333
-    class Internet,Edge edge
-    class LAN,DNS,Vault,Apps,Automation,FileServer,InternalProxy,SSO,EdgeProxy core
-    class Monitoring,SecMon obs
-```
 Solid arrows are real dependencies; dotted arrows are asynchronous telemetry reporting, not a blocking dependency. Full breakdown of all 8 traffic laws (ingress, east-west, secrets, DNS, observability, notifications, CI/CD, management) with the actual trust-boundary reasoning: [docs/architecture-overview.md](docs/architecture-overview.md).
 
 ## Systems

assets/architecture-overview.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Do not edit this file with editors other than draw.io -->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" style="background: transparent; background-color: transparent; color-scheme: light dark;" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="1782px" height="632px" viewBox="0 0 1782 632" id="ge-svg-CaZxomoo-Dbq5azwKi2s" content="&lt;mxfile host=&quot;embed.diagrams.net&quot; scale=&quot;1&quot; border=&quot;0&quot;&gt;&#10;  &lt;diagram name=&quot;Architecture Overview&quot; id=&quot;architecture-overview&quot;&gt;&#10;    &lt;mxGraphModel dx=&quot;1664&quot; dy=&quot;931&quot; grid=&quot;1&quot; gridSize=&quot;10&quot; guides=&quot;1&quot; tooltips=&quot;1&quot; connect=&quot;1&quot; arrows=&quot;1&quot; fold=&quot;1&quot; page=&quot;1&quot; pageScale=&quot;1&quot; pageWidth=&quot;1900&quot; pageHeight=&quot;900&quot; math=&quot;0&quot; shadow=&quot;0&quot;&gt;&#10;      &lt;root&gt;&#10;        &lt;mxCell id=&quot;0&quot; /&gt;&#10;        &lt;mxCell id=&quot;1&quot; parent=&quot;0&quot; /&gt;&#10;        &lt;mxCell id=&quot;internet&quot; parent=&quot;1&quot; style=&quot;ellipse;whiteSpace=wrap;html=1;fillColor=light-dark(#FFFFFF,#292929);strokeColor=#333333;fontColor=light-dark(#333333,#FFFFFF);fontSize=14;&quot; value=&quot;Internet&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;140&quot; x=&quot;40&quot; y=&quot;420&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;edge&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#f8cecc;strokeColor=#b85450;fontSize=14;&quot; value=&quot;Edge Firewall&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;280&quot; y=&quot;420&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;lan&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;LAN&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;140&quot; x=&quot;560&quot; y=&quot;420&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;dns&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;Internal DNS&amp;#xa;two zones&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;800&quot; y=&quot;140&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;vault&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;Vault&amp;#xa;PKI + secrets&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;800&quot; y=&quot;420&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;fileserver&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;File Server&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;800&quot; y=&quot;700&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;edgeproxy&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;User-Facing Proxy&amp;#xa;mTLS&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;1080&quot; y=&quot;140&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;automation&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;Automation VM&amp;#xa;Git + orchestration&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;1080&quot; y=&quot;560&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;apphost&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;&quot; value=&quot;App Host&amp;#xa;41 stacks&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;1360&quot; y=&quot;330&quot; as=&quot;geometry&quot; /&gt;&#10;        &lt;/mxCell&gt;&#10;        &lt;mxCell id=&quot;monitoring&quot; parent=&quot;1&quot; style=&quot;rounded=0;whiteSpace=wrap;html=1;fillColor=#fff2cc;strokeColor=#d6b656;fontSize=14;&quot; value=&quot;Monitoring&quot; vertex=&quot;1&quot;&gt;&#10;          &lt;mxGeometry height=&quot;70&quot; width=&quot;180&quot; x=&quot;1360&quot; y=&quot;560&quot; as=&quot;geometry&quot; /&gt;&#10;    Line truncated