docs: add Mermaid architecture diagrams

docs/architecture/authentication.md

@@ -5,6 +5,20 @@ surface is one CLI, `tht`; there is no separate authentication executable. The b
 opaque browser sessions and authorization, while `tht` owns protected configuration and local-user
 files.
 
+```mermaid
+flowchart TB
+    BROWSER["Browser"] --> BOUNDARY["Authentication boundary"]
+    BOUNDARY --> LOCAL["Local users\nArgon2id hashes"]
+    BOUNDARY --> OIDC["OIDC provider\nAuthorization Code PKCE"]
+    OIDC --> GROUPS["Groups claim\nexact mapping"]
+    LOCAL --> PRINCIPAL["Thoth principal"]
+    GROUPS --> PRINCIPAL
+    PRINCIPAL --> ROLES["Roles"]
+    ROLES --> PERMISSIONS["Permissions"]
+    PERMISSIONS --> ROUTES["Protected routes"]
+    SECRETS["Mounted secret bundle"] -.-> BOUNDARY
+```
+
 ## Configuration and trust boundaries
 
 The installation descriptor points to an operator-controlled authentication directory. It contains