fix: update doc arch

diagrams/architecture.puml

@@ -4,18 +4,19 @@ title After: everything goes through the front
 
 actor Player as player
 node "Master\netmaster.net:27950" as master
+actor "Admin tool\n(tunnel side)" as admin
 
 node "Front (public IP)" {
   component "etrelay\n0.0.0.0:27960" as relay
+  component "control API\n<front-wg>:8090" as control
 }
 
 node "Home" {
-  component "nginx stream\n<wg-peer>:27960" as nginx
-  component "ET server\n<et-server>:27960" as et
+  component "ET server\n<et-server>:27960\n(own WireGuard peer)" as et
 }
 
 player <--> relay : game traffic
 master <--> relay : heartbeat / getChallenge / getInfo
-relay <--> nginx : WireGuard (wg0)
-nginx <--> et : LAN
+relay <--> et : WireGuard (wg0), direct:\none source port per client
+admin --> control : WireGuard: sessions, bans\n(bearer token)
 @enduml