Adds a real drawio-exported diagram to "Why Four Trust Boundaries,
Not One" showing the physical blast-radius split behind the routing-
authority claim in the text (previously prose-only). Sanitized -
verified no real hostnames/IPs made it into the export.
Also reorders all 14 Systems bullets alphabetically for easier
scanning.
No more Mermaid, per standing rule - the architecture diagram is now
a real image (assets/architecture-overview.svg), built and exported
from the Nextcloud Diagramming app, fetched via WebDAV and validated
as well-formed XML before committing. Ends the rendering-gap chase
entirely since there's no live renderer involved anymore, just a
static image.
thesabear