docs: trust-boundary image on Overview

environment-setup/overview.mdx

@@ -1,27 +1,15 @@
 ---
 title: "Overview"
 description: "How tracebloc runs on your infrastructure — and why your data never leaves it."
 ---
 
 **Models come to your data — your data never leaves your infrastructure.** You run a tracebloc *workspace* on your own hardware. Contributors submit models that are scanned and run in isolation against your data, on your machines. Only results leave — and trained model weights only if you choose to share them.
 
 ## The trust boundary
 
-```mermaid
-flowchart LR
-  subgraph YOURS["Your infrastructure"]
-    DATA["Your datasets — raw data"]
-    CLIENT["tracebloc workspace"]
-    TRAIN["Isolated training"]
-    DATA --> TRAIN
-    CLIENT --> TRAIN
-  end
-  CONTRIB["Contributors"] -->|submit models| PLATFORM["tracebloc platform"]
-  PLATFORM -->|scanned models in| CLIENT
-  CLIENT -->|"results out — TLS, outbound-only"| PLATFORM
-  style YOURS fill:#f2fafc,stroke:#0184A3,stroke-width:2px
-  style DATA fill:#e6f6fb,stroke:#0184A3
-```
+<Frame>
+  ![How tracebloc keeps your data on your infrastructure — models come to the data, only results leave](/images/traceblocfederatedlearning.png)
+</Frame>
 
 Raw data stays inside your infrastructure. Your workspace opens an **outbound-only** connection — nothing reaches in to pull your data out.
 
@@ -67,7 +55,7 @@
 
 | Term | What it is |
 |---|---|
 | **Workspace** | Your private, dedicated AI environment — tracebloc's software running on your own infrastructure, where you invite contributors to train models on your data |
 | **Client ID** | The credential that connects your workspace to the platform (created on the clients page) |
 | **Dataset** | Data you've staged locally for use cases |
 | **Use case** | A task contributors build models for, against your datasets |