docs: add architecture, hardening, and building documentation

Document the design and how to operate it: architecture, building
(including toolchain-free/minimal builds), hardening guide, editions,
observability, and the toolchain. README ties it together.

docs/toolchain.md

@@ -0,0 +1,49 @@
+# The Arcline toolchain
+
+Eleven Go tools, built in production at Arcline IT, shipped with Arcline OS.
+The landing page describes them; `toolchain/` packages them.
+
+## The 11 tools
+
+| Tool | What it does |
+|------|--------------|
+| `arcline-uptime` | HTTP / TCP / TLS / DNS monitoring, Prometheus metrics export |
+| `arcline-check` | CDN + transparency auditor (detects data leaks) |
+| `arcline-audit` | full site health scanner — SSL, headers, performance, a11y |
+| `arcline-dns` | DNS propagation checker across resolvers |
+| `arcline-vault` | encrypted secrets store — REST API + CLI |
+| `arcline-email` | self-hosted SMTP/IMAP — OpenSMTPD + Dovecot + Rspamd |
+| `arcline-migrate` | cPanel / Plesk → Arcline migration |
+| `arcline-billing` | Stripe subscription management |
+| `arcline-portal` | customer dashboard — SSL monitoring + ticketing |
+| `arcline-website` | Go HTTP server powering arcline.it |
+| `arcline-status` | static status page generator |
+
+## How they get into the image
+
+```mermaid
+flowchart LR
+    A[tools.list] --> B[build-tools.sh]
+    B --> C[.deb per tool]
+    C --> D[build-rootfs.sh<br/>drops debs into chroot]
+    D --> E[configure-system.sh<br/>dpkg -i *.deb]
+```
+
+1. `make toolchain` (or `toolchain/build-tools.sh`) clones each repo from
+   `git.arcline.it` (or reuses checkouts in `ARCLINE_TOOLS_DIR`), builds a
+   release binary (version stamped via `-ldflags`), and packages a `.deb`
+   from `toolchain/debian/control.tmpl` into `build/debs/`.
+2. `build-rootfs.sh` copies any built debs into the chroot and
+   `configure-system.sh` installs them.
+
+A tool that can't be fetched or built is **skipped with a warning** — the OS
+image never breaks because a repo is unreachable.
+
+## Notes
+
+- Repo list lives in `toolchain/tools.list` (`name|repo|description`).
+- The tools' actual source lives on `git.arcline.it`; this repo is the
+  packaging harness. Each tool gets a proper `Debian` control file with a
+  generated description.
+- The ticket/portal/website tools are the *products*; the others are
+  infrastructure utilities. All are GPL and auditable.