devops(observability): fix C4 diagram, security comment, and add Loki compactor block

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.observability.yml

@@ -100,10 +100,7 @@ services:
     volumes:
       - ./infra/observability/promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
       - /var/lib/docker/containers:/var/lib/docker/containers:ro
-      # /var/run/docker.sock gives Promtail container-name discovery. Trade-off: any
-      # process that can write to this socket can control the Docker daemon (container
-      # escape). Acceptable on a single-operator archive; review if multi-user access
-      # to the host is ever introduced.
+      # :ro restricts file-system access but NOT Docker API permissions — a compromised Promtail has full daemon access. Accepted risk on single-operator self-hosted archive.
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - promtail_positions:/tmp  # persists positions.yaml across restarts — avoids duplicate log ingestion
     command: -config.file=/etc/promtail/promtail-config.yml