Refine public docs generation and simplify topology diagrams

scripts/docs/sanitize-public-docs.py

@@ -21,7 +21,7 @@ def sanitize_text(content: str) -> str:
     return content
 
 
-for name in ['compose-inventory.md', 'traefik-routes.md', 'prometheus-rules.md']:
+for name in ['compose-inventory.md', 'traefik-routes.md']:
     src = src_generated / name
     if src.exists():
         (out_dir / name).write_text(sanitize_text(src.read_text(errors='ignore')))
@@ -36,6 +36,8 @@ for svg_name in ['docker-compose.svg', 'physical-topology.svg', 'docker-traefik-
 
 This documentation is generated from the infrastructure repository. Sensitive values are redacted.
 
+> Generated docs are sanitised/redacted before publishing to GitHub Pages.
+
 ## Infrastructure diagrams
 
 ### Physical / virtual topology
@@ -51,7 +53,6 @@ This documentation is generated from the infrastructure repository. Sensitive va
 - [Diagrams](diagrams.md)
 - [Compose Inventory](compose-inventory.md)
 - [Traefik Routes](traefik-routes.md)
-- [Prometheus Rules](prometheus-rules.md)
 """
 )
 
@@ -60,10 +61,16 @@ This documentation is generated from the infrastructure repository. Sensitive va
 
 ## Physical / virtual topology
 
+This view groups containers by inferred host and service role (edge/proxy/auth, monitoring, automation, apps, and supporting storage/services).
+
 ![Physical topology](physical-topology.svg)
 
 ## Docker, Traefik and Dynu routing
 
+This view shows sanitised public DNS names flowing to Traefik, then to exposed Docker services, with backend Docker network membership shown as secondary context.
+
+_Diagrams are generated from Compose data and Traefik labels._
+
 ![Docker Traefik Dynu](docker-traefik-dynu.svg)
 """
 )