feat: add wordpress site variant

docs/architecture.md

@@ -1,13 +1,23 @@
 # Architecture
 
-Describe the project architecture here.
+NGINX is the only public entry point for `azionelab.org`. It proxies HTTP to the
+official WordPress 7.0/PHP 8.3 Apache image over the private `web` network. WordPress
+connects to MariaDB 11.8 LTS over a separate internal `data` network. Neither WordPress
+nor MariaDB publishes a host port.
 
-Include:
+The custom `azionelab` classic theme renders the public single page. Theme modifications
+store the hero, manifesto, laboratory, teacher, lesson, and contact fields. The
+`azionelab-content` must-use plugin registers Shows and Gallery custom post types so
+structured editorial content survives a theme change. Images use WordPress featured
+images with local SVG fallbacks.
 
-- main components;
-- runtime dependencies;
-- data flow;
-- persistence;
-- external integrations;
-- deployment topology;
-- relevant ADRs.
+WP-CLI is an opt-in tools-profile service. Its idempotent bootstrap installs WordPress,
+activates the theme, configures the site, and creates realistic demo content. Certbot is
+another optional service, enabled only for direct deployments. It shares challenge and
+certificate volumes with NGINX but has no container-control access.
+
+Persistent state lives in `db_data`, `wordpress_data`, and the certificate volumes.
+Functional tests replace the first two with isolated test volumes and reach NGINX via
+an internal `azionelab.org` network alias.
+
+See [ADR-0001](adr/0001-wordpress-single-page.md).