feat: add optional letsencrypt tls

docs/architecture.md

@@ -1,15 +1,21 @@
 # Architecture
 
-The system has four runtime components on the Docker Compose default network:
+The system has four default runtime components and one optional component on the Docker
+Compose network:
 
 1. NGINX accepts requests for `azionelab.org` and routes them by path.
 2. Astro renders the public single page and requests one aggregate JSON document.
 3. Wagtail/Django manages editorial content, serves media in development, and exposes
    the read-only `/api/site/home/` endpoint.
 4. PostgreSQL persists Wagtail content and metadata.
+5. When explicitly enabled, Certbot obtains and renews a Let's Encrypt certificate by
+   writing HTTP-01 challenges and certificate files to shared named volumes.
 
 NGINX sends `/admin`, `/api`, `/documents`, `/health`, `/media`, and `/static` paths to
 Wagtail. All remaining paths go to Astro. Unknown virtual hosts receive a 404 response.
+The ACME challenge path is served directly from its shared volume. If automatic TLS is
+enabled, NGINX starts in HTTP mode, detects the first certificate, adds its HTTPS
+virtual host, redirects application traffic to HTTPS, and reloads after renewals.
 
 The aggregate response contains `settings`, `homepage`, `feature_cards`, `teacher`,
 `lesson_info`, `shows`, and `gallery_items`. Image values contain browser-facing URLs
@@ -23,4 +29,5 @@ Compose volume.
 
 The deployment topology and content model are recorded in
 [ADR-0001](adr/0001-headless-wagtail-astro.md) and
-[ADR-0002](adr/0002-nginx-reverse-proxy.md).
+[ADR-0002](adr/0002-nginx-reverse-proxy.md). Optional TLS termination is recorded in
+[ADR-0003](adr/0003-optional-letsencrypt.md).