Simplify Athena runtime and document current architecture

platform/docker/wireguard-gateway/entrypoint.sh

@@ -64,7 +64,7 @@ wg_ipv4=$(ip -4 -o address show dev wg0 | awk 'NR == 1 { split($4, address, "/")
 # The VPN is Athena's normal application network. Nothing below is published
 # on the physical university interface: every listener is bound inside this
 # namespace to the Fritzbox-assigned WireGuard address. Clients on the home
-# VPN may use OpenWebUI, the router and every useful MCP directly.
+# VPN clients may use the router, speech services and Athena operator directly.
 proxy_pids=""
 start_proxy() {
   listen_port=$1
@@ -74,29 +74,10 @@ start_proxy() {
 }
 
 start_proxy 22   172.30.10.1:22
-start_proxy 8080 open-webui:8080
 start_proxy 8081 router:8081
 start_proxy 8085 tts-gateway:8085
 start_proxy 8091 piper:8085
 start_proxy 8092 xtts:80
-start_proxy 9119 hermes:9119
-start_proxy 8642 hermes:8642
-
-# MCP endpoints. Optional services keep their listener even while stopped and
-# begin working automatically as soon as their container is started.
 start_proxy 8202 mcp-athena-operator:8000
-# Portable general web MCP for Pi, Hermes and other clients. OpenWebUI uses
-# its native broad search by default; both paths are site-agnostic.
-start_proxy 8203 tinysearch:8000
-start_proxy 8204 mcp-github:8000
-start_proxy 8205 mcp-homeassistant:8000
-start_proxy 8206 mcp-arr:8000
-start_proxy 8207 mcp-navidrome:3000
-start_proxy 8208 mcp-unraid-ssh:8000
-
-# Search backends are also directly available for diagnostics and alternative
-# clients. Normal chat clients should prefer the MCP endpoint on 8203.
-start_proxy 8210 searxng:8080
-start_proxy 8211 tinysearch:8000
 
 wait $(printf '%s\n' "$proxy_pids" | awk '{print $2}')