Fix drawio font consistency and add Security Architecture tab

[Copilot]

Summary

Updates docs/user-guide/_assets/Digital_Signage_Architecture.drawio to address two issues:

1. Font consistency fix (Tab 1 — Digital Signage Architecture)

All text in the diagram now uses a uniform font size and weight:

• docker_net border label: fontSize=12 → fontSize=11 (matches all service boxes)
• All 12 edge labels: fontStyle=1 (bold) → fontStyle=0 (normal) — consistent weight at fontSize=10
• 3 data-mount dashed edge labels: fontSize=9 → fontSize=10
• 8 inline <font size="9"> HTML tags replaced with <font color="#888888"> — secondary port/device info now uses the same muted-colour approach as version strings, eliminating the size inconsistency

2. New Security Architecture tab (Tab 2)

A second diagram page added to cover the Docker deployment security posture:

• External / Untrusted Zone: Browser client, exposed port inventory (TCP :5000, UDP/TCP :3478)
• Entry Point zone: nginx (TLS 1.3, reverse proxy targets) and COTURN (HMAC shared-secret token auth)
• Docker Bridge Network (app_network): Video Streaming, Core Services, and AI Services groups — each service annotated with its internal port and auth status
• ⚠ Unauthenticated services flagged: MQTT :1883 and ChromaDB :8000 carry visible warnings
• Host Volume mounts: CSV data, ad images, AI models (read-only), chroma_data, TLS certs
• Security recommendations panel: replace self-signed cert, enable MQTT auth, add ChromaDB API token, non-root containers, read-only mounts, rotate TURN secret
• Legend: encrypted flows, plaintext internal flows, read-only volume mounts

Files changed

• docs/user-guide/_assets/Digital_Signage_Architecture.drawio