docs(d2): update architecture and api-routing diagrams to current state

architecture.d2:
- Split app into prod VPS (165.22.70.138) and homelab runner (192.168.0.109)
- Add CrowdSec, Dozzle agent, pocket-tts (voice samples)
- Valkey now shown as Asynq job queue in addition to presign cache
- Add caddy-l4 Redis TCP proxy (:6380) to Caddy label
- Add CI/CD node (Gitea Actions) with full job list incl. releases.json bake
- Remove runner from prod app group (it runs on homelab only)
- Watchtower: note runner is label-disabled on prod

api-routing.d2:
- Add /api/presign/* routes to backend (presign_be group)
- Add /api/audio POST + status GET to both sk and be
- Add /api/scrape/book and /api/scrape/book/range to scrape_sk
- Catalogue: annotate Meilisearch vs legacy browse
- Add Meilisearch filter/sort fields to storage node
- Add Asynq queue note to Valkey storage node
- Fix presign proxy: sk routes through be.presign_be, not directly to storage

docs/d2/api-routing.d2

@@ -35,11 +35,11 @@ client: Browser / iOS App {
 caddy: Caddy :443 {
   shape: rectangle
   style.fill: "#f1f5f9"
-  label: "Caddy :443\ncustom build · caddy-ratelimit\nsecurity headers · rate limiting\nstatic error pages"
+  label: "Caddy :443\ncustom build · caddy-l4 · caddy-ratelimit\nCrowdSec bouncer · security headers\nrate limiting · static error pages\nRedis TCP proxy :6380"
 }
 
 # ─── SvelteKit UI ─────────────────────────────────────────────────────────────
-# Handles: auth enforcement, session, all /api/* routes that have SK counterparts
+# All routes here pass through SvelteKit — auth is enforced server-side.
 
 sk: SvelteKit UI :3000 {
   style.fill: "#fef3c7"
@@ -53,7 +53,7 @@ sk: SvelteKit UI :3000 {
   catalogue_sk: Catalogue {
     style.fill: "#f0fdf4"
     style.stroke: "#86efac"
-    label: "GET /api/catalogue-page\nGET /api/search"
+    label: "GET /api/catalogue-page  (infinite scroll)\nGET /api/search"
   }
 
   book_sk: Book {
@@ -65,7 +65,7 @@ sk: SvelteKit UI :3000 {
   scrape_sk: Scrape (admin) {
     style.fill: "#fff7ed"
     style.stroke: "#fdba74"
-    label: "GET  /api/scrape/status\nGET  /api/scrape/tasks\nPOST /api/scrape\nPOST /api/scrape/range\nPOST /api/scrape/cancel/{id}"
+    label: "GET  /api/scrape/status\nGET  /api/scrape/tasks\nPOST /api/scrape\nPOST /api/scrape/book\nPOST /api/scrape/book/range\nPOST /api/scrape/cancel/{id}"
   }
 
   audio_sk: Audio {
@@ -74,7 +74,7 @@ sk: SvelteKit UI :3000 {
     label: "POST /api/audio/{slug}/{n}\nGET  /api/audio/status/{slug}/{n}\nGET  /api/voices"
   }
 
-  presign_sk: Presigned URLs {
+  presign_sk: Presigned URLs (public) {
     style.fill: "#f0fdf4"
     style.stroke: "#86efac"
     label: "GET /api/presign/chapter/{slug}/{n}\nGET /api/presign/audio/{slug}/{n}\nGET /api/presign/voice-sample/{voice}"
@@ -106,12 +106,12 @@ sk: SvelteKit UI :3000 {
 }
 
 # ─── Go Backend ───────────────────────────────────────────────────────────────
-# Caddy proxies these paths directly — no SvelteKit auth layer
+# Caddy proxies these paths directly — bypasses SvelteKit entirely.
 
 be: Backend API :8080 {
   style.fill: "#eef3ff"
 
-  health_be: Health {
+  health_be: Health / Version {
     style.fill: "#f0fdf4"
     style.stroke: "#86efac"
     label: "GET /health\nGET /api/version"
@@ -126,7 +126,7 @@ be: Backend API :8080 {
   catalogue_be: Catalogue {
     style.fill: "#f0fdf4"
     style.stroke: "#86efac"
-    label: "GET /api/browse\nGET /api/catalogue\nGET /api/ranking\nGET /api/cover/{domain}/{slug}"
+    label: "GET /api/catalogue  (Meilisearch)\nGET /api/browse  (legacy MinIO cache)\nGET /api/ranking\nGET /api/cover/{domain}/{slug}"
   }
 
   book_be: Book / Chapter {
@@ -138,7 +138,13 @@ be: Backend API :8080 {
   audio_be: Audio {
     style.fill: "#f0fdf4"
     style.stroke: "#86efac"
-    label: "GET /api/audio-proxy/{slug}/{n}\nGET /api/voices"
+    label: "POST /api/audio/{slug}/{n}\nGET  /api/audio/status/{slug}/{n}\nGET  /api/audio-proxy/{slug}/{n}\nGET  /api/voices"
+  }
+
+  presign_be: Presigned URLs {
+    style.fill: "#f0fdf4"
+    style.stroke: "#86efac"
+    label: "GET /api/presign/chapter/{slug}/{n}\nGET /api/presign/audio/{slug}/{n}\nGET /api/presign/voice-sample/{voice}\nGET /api/presign/avatar-upload/{userId}\nGET /api/presign/avatar/{userId}"
   }
 }
 
@@ -149,19 +155,19 @@ storage: Storage {
 
   pb: PocketBase :8090 {
     shape: cylinder
-    label: "auth · books · progress\ncomments · library\nscrape_jobs · audio_cache"
+    label: "auth · books · progress\ncomments · library\nscrape_jobs · audio_cache\nranking"
   }
   mn: MinIO :9000 {
     shape: cylinder
-    label: "chapters · audio\navatars · browse"
+    label: "chapters · audio\navatars · catalogue (browse)"
   }
   ms: Meilisearch :7700 {
     shape: cylinder
-    label: "index: books"
+    label: "index: books\nfilterable: status · genres\nsortable: rank · rating\n  total_chapters · meta_updated"
   }
   vk: Valkey :6379 {
     shape: cylinder
-    label: "presign URL cache"
+    label: "presign URL cache (TTL ~55 min)\nAsynq job queue (runner)"
   }
 }
 
@@ -169,18 +175,17 @@ storage: Storage {
 
 client -> caddy: HTTPS :443
 
-caddy -> sk: "/* (catch-all)\n→ SvelteKit handles auth"
-caddy -> be: "/health  /scrape*\n/api/browse  /api/book-preview/*\n/api/chapter-text/*  /api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*  /api/catalogue  /api/ranking"
-caddy -> storage.mn: "/avatars/*\n/audio/*\n/chapters/*\n(presigned MinIO GETs)"
+caddy -> sk: "/* (catch-all)\n→ SvelteKit enforces auth"
+caddy -> be: "/health  /scrape*\n/api/browse  /api/catalogue  /api/ranking\n/api/version  /api/book-preview/*\n/api/chapter-text/*  /api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio*  /api/voices  /api/presign/*"
+caddy -> storage.mn: "/avatars/*  /audio/*  /chapters/*\n(presigned MinIO GETs)"
 
 # ─── SvelteKit → Backend (server-side proxy) ──────────────────────────────────
 
 sk.catalogue_sk -> be.catalogue_be: internal proxy
 sk.book_sk -> be.book_be: internal proxy
 sk.audio_sk -> be.audio_be: internal proxy
-sk.presign_sk -> storage.vk: check cache
-sk.presign_sk -> storage.mn: generate presign
-sk.presign_user -> storage.mn: generate presign
+sk.presign_sk -> be.presign_be: internal proxy
+sk.presign_user -> be.presign_be: internal proxy
 
 # ─── SvelteKit → Storage (direct) ────────────────────────────────────────────
 
@@ -192,10 +197,12 @@ sk.comments_sk -> storage.pb
 
 # ─── Backend → Storage ────────────────────────────────────────────────────────
 
-be.catalogue_be -> storage.ms: full-text search
+be.catalogue_be -> storage.ms: full-text search + facets
 be.catalogue_be -> storage.pb: ranking records
 be.catalogue_be -> storage.mn: cover presign
 be.book_be -> storage.mn: chapter objects
 be.book_be -> storage.pb: book metadata
 be.audio_be -> storage.mn: audio presign
 be.audio_be -> storage.vk: presign cache
+be.presign_be -> storage.vk: check / set presign cache
+be.presign_be -> storage.mn: generate presigned URL