docs: refresh architecture diagram and clarify onboarding prerequisites

[Hou (SciencePotato)]

Summary

• Replace the single-region architecture image with an exact rendering of page 1 from the user-revised EPP Architecture diagrams PDF.
• Clarify live delivery versus non-delivering evaluation (mode: 2), independent credential refresh, and 401/403 authentication failures.
• Explain that East US in the diagram is illustrative and EP1 quota is subscription- and region-specific; add quota troubleshooting and cross-links.
• Explicitly scope guided onboarding to one region. Front Door onboarding remains deferred until regional recovery validation passes.

Front Door scope

Authenticated encrypted evaluation and origin protection passed in a separate experiment, but the stricter recovery check did not. This PR does not claim end-to-end Front Door validation, add manual Front Door onboarding, publish the experimental script, or change application/infra/pipeline code. The user confirmed that Front Door onboarding should be added only after recovery is verified.

Three validation passes

1. Image: rendered only PDF page 1 at 1800 x 1475, verified pixel equality with the source rendering, and visually inspected it. Original labels preserved; multi-region page excluded.
2. Content: checked setup prerequisites, runtime choices, authentication, certificate handling, and evaluation wording against current main setup/runtime code and supporting documentation; checked the official Azure quota documentation link.
3. Navigation and examples: validated 169 local links/anchors across nine documents; parsed root README PowerShell snippets without executing them; verified one image, provider-neutral root onboarding, and clean git diff --check.

Documentation-only change; no Azure deployment or application tests were run for this PR. Existing Front Door experimental changes are preserved separately on feature/frontdoor-e2e and excluded from this diff.