Update docs: Mermaid diagrams, current verification state

- Replace ASCII art with Mermaid in architecture-design-company-inc.md
- Rewrite architecture-hld.md with 3 Mermaid diagrams (infra, CI/CD, security)
- Remove draw.io/Lucidchart references
- Update verification-log.md with current passing state

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/architecture-hld.md

@@ -1,85 +1,88 @@
 # High-Level Architecture Diagram: Company Inc.
 
-Use this as reference when creating your diagram in [draw.io](https://draw.io) or [Lucidchart](https://lucidchart.com).
-
-## Mermaid Source (for Git-rendered diagrams)
+## Cloud Infrastructure (GCP + GKE)
 
 ```mermaid
 flowchart TB
-    subgraph Internet["Internet"]
-        Users[Users]
+    subgraph Internet
+        Users((Users))
     end
 
-    subgraph GCP["GCP"]
-        subgraph Projects["Projects"]
+    subgraph GCP["Google Cloud Platform"]
+        subgraph Projects["Project Structure"]
             Prod[company-inc-prod]
             Staging[company-inc-staging]
             Shared[company-inc-shared]
+            Sandbox[company-inc-sandbox]
         end
 
-        subgraph Networking["Network"]
-            LB[Cloud Load Balancer<br/>HTTPS]
+        subgraph Edge["Edge / Networking"]
+            LB[Cloud Load Balancer<br/>HTTPS · TLS termination]
             CDN[Cloud CDN<br/>Static Assets]
-            VPC[VPC - Private Subnets]
+            NAT[Cloud NAT<br/>Egress]
         end
 
-        subgraph GKE["GKE Cluster (Private)"]
-            Ingress[Ingress Controller]
-            subgraph Workloads["Workloads"]
-                API[Backend - Python/Flask<br/>HPA 2-3 replicas]
-                SPA[Frontend - React SPA<br/>Nginx]
+        subgraph VPC["VPC — Private Subnets"]
+            subgraph GKE["GKE Autopilot Cluster"]
+                Ingress[Ingress Controller]
+                subgraph Workloads
+                    API[Backend — Python / Flask<br/>HPA · 2–3 replicas]
+                    SPA[Frontend — React SPA<br/>Nginx]
+                end
+                Redis[Redis — Memorystore<br/>Session / Cache]
+                Monitoring[Prometheus + Grafana<br/>Observability]
             end
-            Redis[Redis - Memorystore]
         end
 
-        subgraph Data["Data & Services"]
-            Mongo[(MongoDB Atlas<br/>Replica Set)]
+        subgraph Managed["Managed Services"]
+            Mongo[(MongoDB Atlas<br/>3-node Replica Set<br/>Private Endpoint)]
             Secrets[Secret Manager]
             Registry[Artifact Registry]
         end
     end
 
+    subgraph CICD["CI / CD"]
+        Git[Git Repository]
+        Actions[Gitea / GitHub Actions<br/>Build · Test · Scan]
+        Argo[ArgoCD / Flux<br/>GitOps Deploy]
+    end
+
     Users --> LB
     Users --> CDN
     LB --> Ingress
+    CDN --> SPA
     Ingress --> API
     Ingress --> SPA
-    CDN --> SPA
-    API --> Mongo
     API --> Redis
+    API --> Mongo
     API --> Secrets
     GKE --> Registry
+    GKE --> NAT
+
+    Git --> Actions
+    Actions --> Registry
+    Argo --> GKE
 ```
 
-## Draw.io / Lucidchart Layout Guide
+## CI / CD Pipeline
 
-### Top Row (External)
-- **Users** → Internet
+```mermaid
+flowchart LR
+    Dev[Developer] -->|push| Repo[Git Repo]
+    Repo -->|webhook| CI[CI Pipeline<br/>lint · test · build]
+    CI -->|push image| Registry[Artifact Registry]
+    CI -->|update manifests| GitOps[GitOps Repo]
+    GitOps -->|sync| Argo[ArgoCD / Flux]
+    Argo -->|deploy| GKE[GKE Cluster]
+```
 
-### Second Row (Edge)
-- **Cloud Load Balancer** (HTTPS)
-- **Cloud CDN** (for SPA static assets)
+## Network Security Layers
 
-### Third Row (GKE)
-- **GKE Cluster** (Private)
-  - Ingress Controller
-  - Backend (Flask) — 2–3 replicas, HPA
-  - Frontend (React SPA)
-  - Redis (Memorystore)
-
-### Fourth Row (Data)
-- **MongoDB Atlas** (Replica Set, private endpoint)
-- **Secret Manager**
-- **Artifact Registry**
-
-### Connections
-1. Users → LB, Users → CDN
-2. LB → Ingress → Backend + Frontend
-3. Backend → MongoDB, Redis, Secret Manager
-4. GKE → Artifact Registry (image pulls)
-
-### Colors (suggested)
-- External: Light blue
-- GCP managed: Light green
-- Workloads: Light yellow
-- Data: Light orange
+```mermaid
+flowchart TD
+    Internet((Internet)) --> FW[VPC Firewall<br/>Default deny]
+    FW --> LB[Load Balancer<br/>HTTPS only]
+    LB --> NP[K8s Network Policies]
+    NP --> Pods[Application Pods<br/>Private IPs only]
+    Pods --> PE[Private Endpoint<br/>MongoDB Atlas]
+```