docs: render architecture & flow diagrams as draw.io charts

Replace ASCII-art diagrams across the README and docs/ with editable
.drawio sources plus exported PNGs, so the diagrams render clearly in
rendered markdown and can be maintained/regenerated instead of being
hand-edited as fragile text art. Non-diagram blocks (code, folder
trees, UI wireframes) were left as text.

README.md

@@ -110,102 +110,10 @@ Both stacks share the infrastructure services in [`infra/`](infra/) (MS SQL, LDA
 
 ### Architecture Diagram (Logical)
 
-```
-                    Users (Blazor Server)
-                         │
-                    Load Balancer
-                         │
-┌────────────────────────┼────────────────────────────┐
-│                   CENTRAL CLUSTER                    │
-│              (2-node active/standby)                 │
-│                                                      │
-│  ┌──────────┐ ┌──────────┐ ┌──────────┐            │
-│  │ Template  │ │Deployment│ │ Central  │            │
-│  │ Engine    │ │ Manager  │ │ UI       │ Blazor Svr │
-│  └──────────┘ └──────────┘ └──────────┘            │
-│  ┌──────────┐ ┌──────────┐ ┌──────────┐            │
-│  │ Security  │ │  Config  │ │  Health  │            │
-│  │ & Auth    │ │   DB     │ │ Monitor  │            │
-│  │ (JWT/LDAP)│ │ (EF+IAud)│ │          │            │
-│  └──────────┘ └──────────┘ └──────────┘            │
-│  ┌──────────┐                                       │
-│  │ Inbound  │  ◄── External Systems (X-API-Key)     │
-│  │ API      │      POST /api/{method}, JSON         │
-│  └──────────┘                                       │
-│  ┌──────────┐                                       │
-│  │ Mgmt     │  ◄── CLI (ClusterClient)              │
-│  │ Service  │      ManagementActor + Receptionist   │
-│  └──────────┘                                       │
-│  ┌──────────┐ ┌──────────┐ ┌──────────┐            │
-│  │   Ntf    │ │   Site   │ │  Audit   │ Observ. /   │
-│  │  Outbox  │ │   Call   │ │   Log    │ Audit area  │
-│  │ (#21)    │ │  Audit   │ │  (#23)   │             │
-│  │          │ │  (#22)   │ │          │             │
-│  └────▲─────┘ └────▲─────┘ └────▲─────┘            │
-│       │ ingests    │ ingests    │ ingests          │
-│       │ (S&F)      │ (telemetry)│ (telemetry +     │
-│       │            │            │  direct-write    │
-│       │            │            │  from Ntf Outbox │
-│       │            │            │  & Inbound API)  │
-│  ┌───────────────────────────────────┐              │
-│  │    Akka.NET Communication Layer   │              │
-│  │  ClusterClient: command/control   │              │
-│  │  gRPC Client: real-time streams   │              │
-│  │  (correlation IDs, per-pattern    │              │
-│  │   timeouts, message ordering)     │              │
-│  └──────────────┬────────────────────┘              │
-│  ┌──────────────┴────────────────────┐              │
-│  │    Configuration Database (EF)    │──► MS SQL    │
-│  └───────────────────────────────────┘   (Config DB)│
-│                  │                    Machine Data DB│
-└─────────────────┼───────────────────────────────────┘
-                  │ Akka.NET Remoting (command/control)
-                  │ gRPC HTTP/2 (real-time data, port 8083)
-     ┌────────────┼────────────┐
-     ▼            ▼            ▼
-┌─────────┐ ┌─────────┐ ┌─────────┐
-│ SITE A  │ │ SITE B  │ │ SITE N  │
-│ (2-node)│ │ (2-node)│ │ (2-node)│
-│ ┌─────┐ │ │ ┌─────┐ │ │ ┌─────┐ │
-│ │Data │ │ │ │Data │ │ │ │Data │ │
-│ │Conn │ │ │ │Conn │ │ │ │Conn │ │
-│ │Layer │ │ │ │Layer │ │ │ │Layer │ │
-│ ├─────┤ │ │ ├─────┤ │ │ ├─────┤ │
-│ │Site │ │ │ │Site │ │ │ │Site │ │
-│ │Runtm│ │ │ │Runtm│ │ │ │Runtm│ │
-│ ├─────┤ │ │ ├─────┤ │ │ ├─────┤ │
-│ │gRPC │ │ │ │gRPC │ │ │ │gRPC │ │
-│ │Srvr │ │ │ │Srvr │ │ │ │Srvr │ │
-│ ├─────┤ │ │ ├─────┤ │ │ ├─────┤ │
-│ │S&F  │ │ │ │S&F  │ │ │ │S&F  │ │
-│ │Engine│ │ │ │Engine│ │ │ │Engine│ │
-│ ├─────┤ │ │ ├─────┤ │ │ ├─────┤ │
-│ │ExtSys│ │ │ │ExtSys│ │ │ │ExtSys│ │
-│ │Gatwy │ │ │ │Gatwy │ │ │ │Gatwy │ │
-│ └─────┘ │ │ └─────┘ │ │ └─────┘ │
-│ SQLite  │ │ SQLite  │ │ SQLite  │
-└─────────┘ └─────────┘ └─────────┘
-     │            │            │
-  OPC UA /     OPC UA /     OPC UA /
-  Custom       Custom       Custom
-  Protocol     Protocol     Protocol
-```
+![Logical architecture](diagrams/architecture-logical.png)
+<!-- source: diagrams/architecture-logical.drawio — edit, then re-export with export-drawio.sh -->
 
 ### Site Runtime Actor Hierarchy
 
-```
-Deployment Manager Singleton (Cluster Singleton)
-├── Instance Actor (one per deployed, enabled instance)
-│   ├── Script Actor (coordinator, one per instance script)
-│   │   └── Script Execution Actor (short-lived, per invocation)
-│   ├── Alarm Actor (coordinator, one per alarm definition)
-│   │   └── Alarm Execution Actor (short-lived, per on-trigger invocation)
-│   └── ... (more Script/Alarm Actors)
-├── Instance Actor
-│   └── ...
-└── ... (more Instance Actors)
-
-Site-Wide Akka Stream (attribute + alarm state changes)
-├── All Instance Actors publish to the stream
-└── Debug view subscribes with instance-level filtering
-```
+![Site runtime actor hierarchy](diagrams/site-runtime-actor-hierarchy.png)
+<!-- source: diagrams/site-runtime-actor-hierarchy.drawio — edit, then re-export with export-drawio.sh -->