milestone 23 s3: move srOnly into the shared style vocabulary

README.md

@@ -1,9 +1,19 @@
 # nxdns
 
-A self-hosted DNS sinkhole for a household LAN, written in Zig 0.16. One
-static musl binary, SQLite for state, a Raspberry Pi 5 as the reference
-target. It answers your network's DNS, blocks what you tell it to, and shows
-you what asked for what.
+nxdns is a DNS sinkhole for your LAN. It blocks the names you do not want, and
+forwards the rest over an encrypted connection.
+
+```mermaid
+flowchart LR
+    devices["Your devices"] -- "DNS query" --> nxdns["nxdns"]
+    nxdns -- "answer" --> devices
+    nxdns -- "allowed" --> upstream["Upstream resolvers<br/>DoH / DoT"]
+    upstream -- "answer" --> nxdns
+    nxdns -- "blocked" --> sink["0.0.0.0 / NXDOMAIN"]
+```
+
+One static Zig binary. SQLite holds the state and the query log, which the web
+UI, the REST API and `/metrics` read.
 
 ## Features