Redraw the architecture map, which had five packages missing from it

The layer diagram showed ui, data, net, protocol and subscription. Since it was
written the app has grown vpn, routing, dns, apps and nodes — five packages, one
of which is the TUN itself — and a map that omits the layer a reader is looking
for sends them to read the source instead, which is what the map exists to
avoid.

It also said the coverage gate is on the wire layer. It is on six packages, and
the reason they are all in it is worth stating where somebody deciding where to
put new code will read it: they are the same kind of code, where a wrong answer
is wrong silently, and in routing and nodes it is wrong in the worst direction.

Author: AlbertoDeckow

docs/architecture.md

@@ -7,14 +7,26 @@ What the layers are, which way they depend, and the rules that keep them apart.
 ```
 ui/            screens, theme, icons, presentation state
   ↓
+vpn/           VpnService · TUN configuration · lwIP bridge · flow handler · tile
+  ↓
 data/          NodeStore · SubscriptionStore · NodeRepository
+nodes/         NodeHealth · Failover — which node carries the traffic
+routing/       rules, the direct path, the reject path
+dns/           interception, the fake-IP pool, both families
+apps/          which applications the tunnel carries
   ↓
 net/           NowhereDialer — TLS, ALPN, certificate verification
   ↓
 protocol/      the wire. auth · frame · mux · quic · session · target · tls · url
-subscription/  the dashboard's HTTP surface
+subscription/  the dashboard's HTTP surface, and its scheduled refresh
 ```
 
+Six of those packages carry the 90% coverage gate rather than one:
+`protocol/`, `subscription/`, `dns/`, `apps/`, `routing/` and `nodes/`. They are
+not all the wire, but they are all the same *kind* of code — a wrong answer is
+wrong silently, and in `routing/` and `nodes/` it is wrong in the worst
+direction, with traffic leaving the device somewhere the user did not ask.
+
 **Dependencies point down and never up.** `protocol/` knows nothing about
 Android — no `Context`, no resource, no `Log` — which is why every protocol test
 runs on the JVM in milliseconds and can be pointed at a real Portal without a