docs: reflect enrichment, TLS, and detached sources in architecture

The README ASCII diagram and assets/architecture.mmd predated three
unreleased features already documented in CHANGELOG.md: post-evaluation
enrichment (#134), server-side TLS for the daemon API listener (#128),
and detached dynamic sources (#135). Update both surfaces so they match
what the next release ships.

README prose and ASCII diagram:
- Add an Enrichment bullet to the streaming-runtime section listing the
  four primitives (template, lookup, http, command), the kind-aware
  ${detection.*} / ${correlation.*} namespaces, scope filter, HTTP
  response cache, and the on_error policies.
- Insert an enrichment/ block in the rsigma-runtime ASCII diagram
  between RuntimeEngine and io/, and route the flow through it.
- Mention TLS termination (mTLS, cert hot-reload) on the shared API
  listener in the io/ block.
- Mention DaemonSourceRegistry (external --source + pipeline-embedded
  deprecated, collision-error) in the sources/ block.
- Note the enrichments map in the EvaluationResult output box and the
  Output bullet of the prose.

Mermaid diagram (assets/architecture.mmd):
- Add 'enrichments' to the RuleHeader line in the OUTPUT node.
- Add a new RENRICH node and wire RENG --> RENRICH --> RIO.
- Mention TLS termination in the RIO node.
- Mention DaemonSourceRegistry, --source, and the collision-error
  semantics in the RSRC node.

Verified with mmdc: assets/architecture.mmd renders cleanly.

Author: mostafa

README.md

@@ -402,7 +402,8 @@ When running as a streaming detection engine, `rsigma-eval` feeds into `rsigma-r
 - **Input:** Format adapters parse raw log lines (JSON, syslog, logfmt\*, CEF\*, plain text, with auto-detection) into `EventInputDecoded`. EVTX\* files are parsed directly from binary via `EvtxFileReader`. Sources include stdin, HTTP POST, NATS JetStream, and OTLP\* (HTTP protobuf/JSON and gRPC).
 - **Dynamic sources:** `SourceResolver` fetches data from files, commands, HTTP APIs, and NATS subjects. Resolved values are injected into pipelines via `TemplateExpander`. A `SourceCache` (in-memory + optional SQLite) provides fallback data. `RefreshScheduler` manages auto-refresh (interval, file watch, NATS push, on-demand). Extraction supports jq, JSONPath, and CEL. `DaemonSourceRegistry` unifies sources from external files (`--source`) and pipeline-embedded declarations with collision-error semantics.
 - **Processing:** `LogProcessor` runs batch evaluation with parallel detection and sequential correlation. `RuntimeEngine` wraps `Engine` and `CorrelationEngine` with rule loading and `ArcSwap` hot-reload.
-- **Output:** Sinks write evaluation results to stdout, files, or NATS as one flat JSON object per result. Multiple sinks can run in fan-out. The output type is `EvaluationResult` (a composition of `RuleHeader` + `ResultBody::Detection|Correlation`), carrying rule title, id, level, tags, matched selections, field matches, aggregated values, and optionally the triggering events.
+- **Enrichment:** `EnrichmentPipeline` runs between the engine and the sinks, injecting context (asset info, IP reputation, identity, GeoIP, KEV flags, runbook URLs, ...) into each result's `RuleHeader.enrichments` map. Four primitives (`template`, `lookup`, `http`, `command`) compose into recipes. Kind-aware template namespaces (`${detection.*}` for detection-kind enrichers, `${correlation.*}` for correlation-kind) are validated at config-load time. Optional HTTP response cache, scope filtering by rule glob, tag set, and severity, and `on_error` policies (`skip`, `null`, `drop`).
+- **Output:** Sinks write evaluation results to stdout, files, or NATS as one flat JSON object per result. Multiple sinks can run in fan-out. The output type is `EvaluationResult` (a composition of `RuleHeader` + `ResultBody::Detection|Correlation`), carrying rule title, id, level, tags, the `enrichments` map written by the enrichment pipeline, matched selections, field matches, aggregated values, and optionally the triggering events.
 
 Feature-gated items are marked with \* in the diagram.
 
@@ -485,6 +486,9 @@ Feature-gated items are marked with \* in the diagram.
     │    ↓ raw line → EventInputDecoded        │
     │                                          │
     │  sources/ ──> dynamic pipelines:         │
+    │    DaemonSourceRegistry: external        │
+    │      (--source) + pipeline-embedded      │
+    │      (deprecated), collision-error       │
     │    SourceResolver (HTTP, command,        │
     │      file, NATS subjects)                │
     │    TemplateExpander (${source.*})        │
@@ -505,8 +509,21 @@ Feature-gated items are marked with \* in the diagram.
     │  RuntimeEngine ──> wraps Engine +        │
     │    CorrelationEngine with rule loading   │
     │                                          │
+    │  enrichment/ ──> post-eval pipeline:     │
+    │    primitives: template, lookup,         │
+    │      http, command                       │
+    │    kind-aware namespaces:                │
+    │      ${detection.*}, ${correlation.*}    │
+    │    scope filter (rules, tags, levels)    │
+    │    HTTP response cache, on_error policy  │
+    │    └──> writes RuleHeader.enrichments    │
+    │         between engine and sinks         │
+    │                                          │
     │  io/ ──> EventSource (stdin, HTTP, NATS) │
     │          OTLP* (HTTP + gRPC)             │
+    │          TLS* termination (mTLS, cert    │
+    │            hot-reload) on shared API     │
+    │            listener                      │
     │          Sink (stdout, file, NATS)       │
     │          DLQ (failed events)             │
     └──────────────────────────────────────────┘
@@ -515,9 +532,10 @@ Feature-gated items are marked with \* in the diagram.
               ▼
      ┌────────────────────────┐
      │  EvaluationResult      │──> rule title, id, level, tags,
-     │  = RuleHeader +        │    matched selections, field matches,
-     │    ResultBody::        │    aggregated values, optional events
-     │      Detection /       │
+     │  = RuleHeader (incl.   │    enrichments map, matched
+     │    enrichments) +      │    selections, field matches,
+     │    ResultBody::        │    aggregated values, optional
+     │      Detection /       │    events
      │      Correlation       │
      └────────────────────────┘
 ```

assets/architecture.mmd

@@ -2,7 +2,7 @@ flowchart TD
     YAML["YAML input"]
     SERDE["yaml_serde"]
     EVENTS["Log events"]
-    OUTPUT["EvaluationResult\nRuleHeader: title · id · level · tags\nResultBody: Detection (matched fields/selections) ·\nCorrelation (correlation_type · group_key · aggregated_value)"]
+    OUTPUT["EvaluationResult\nRuleHeader: title · id · level · tags · enrichments\nResultBody: Detection (matched fields/selections) ·\nCorrelation (correlation_type · group_key · aggregated_value)"]
     QUERIES["SQL · SPL · KQL · Lucene"]
     EDITOR["Editor diagnostics + code actions"]
     LEGEND["* = feature-gated\n** = requires daachorse-index feature"]
@@ -45,8 +45,9 @@ flowchart TD
         RINPUT["input/ format adapters:\nJSON · syslog · logfmt* · CEF* · EVTX*\nplain text · auto-detect\nraw line → EventInputDecoded"]
         RINPUT --> RPROC["LogProcessor\nbatch evaluation\nArcSwap hot-reload (rules + pipelines)\nMetricsHook · EventFilter"]
         RPROC --> RENG["RuntimeEngine\nwraps Engine + CorrelationEngine\nwith rule loading"]
-        RENG --> RIO["io/\nEventSource (stdin · HTTP · NATS)\nOTLP* (HTTP + gRPC)\nSink (stdout · file · NATS) · DLQ"]
-        RSRC["sources/ (dynamic pipelines)\nSourceResolver: HTTP · command · file · NATS\nTemplateExpander · SourceCache (SQLite TTL)\nRefreshScheduler: interval · watch · push\nSIGHUP · NATS control · includes\nextract: jq · JSONPath · CEL"]
+        RENG --> RENRICH["enrichment/ post-eval pipeline\nprimitives: template · lookup · http · command\nkind-aware: ${detection.*} · ${correlation.*}\nscope filter · HTTP response cache · on_error\nwrites RuleHeader.enrichments"]
+        RENRICH --> RIO["io/\nEventSource (stdin · HTTP · NATS)\nOTLP* (HTTP + gRPC)\nTLS* termination (mTLS · cert hot-reload)\non shared API listener\nSink (stdout · file · NATS) · DLQ"]
+        RSRC["sources/ (dynamic pipelines)\nDaemonSourceRegistry: external (--source) +\npipeline-embedded (deprecated) · collision-error\nSourceResolver: HTTP · command · file · NATS\nTemplateExpander · SourceCache (SQLite TTL)\nRefreshScheduler: interval · watch · push\nSIGHUP · NATS control · includes\nextract: jq · JSONPath · CEL"]
     end
 
     YAML -->|"Raw YAML Value"| SERDE