docs: clarify request paths and offline test setup

[Hou (SciencePotato)]

Summary

• Preserve both original architecture PNGs byte-for-byte at their original paths and keep them embedded in the technical and Front Door guides. Clarify their schematic timing, telemetry, names/version IDs, and response-arrow limitations in the surrounding text.
• Add a concrete SMS sign-in UML including the end user (browser and phone), existing application, Microsoft Entra ID, protected endpoint, and provider. Separate provider acceptance from recipient delivery, then show the person entering the code, identity verification, and application access checks. Explicitly distinguish the user's sign-in app from the dedicated endpoint registration.
• Add two real, unmodified official portal screenshots: Function Settings > Environment variables > App settings, and Key Vault Certificate Version > Certificate Identifier. Give exact resource-summary fields, setting names, selection steps, and prohibited wrong fields/actions. Replace the abstract certificate map instead of keeping a redundant second picture.
• Remove redundant additions: the onboarding roadmap repeated the main README's numbered stages; the monitoring map repeated the monitoring introduction; the replacement architecture artwork overlapped the preserved topology views and retained UML sequence.
• Add short offline-test sections with exact CI-aligned commands and working directories to each runtime README. Keep the general BYOT guide instructions-only, with shared prerequisites, the full-checkout requirement, and links to those runtime commands. Link the request illustration from onboarding and BYOT.
• Keep the root README and monitoring guide unchanged from base after pruning. Guided setup behavior, existing portal screenshots, sign-in monitoring instructions, and the separate hosting-cost changes in docs: add Azure hosting cost estimates #50 remain untouched.

Review scope

Reviewed all 16 tracked Markdown guides: the root README and technical reference; onboarding, BYOT, HTTP contract, monitoring, Application Insights, Entra sign-in monitoring, cost estimation, Front Door, and provider fallback; both setup references; and all three runtime READMEs. Also inspected all 16 existing image assets, captions/alt text/navigation, sample settings, launcher prompts and output fields, relevant handlers/provider registration, CI, and packaging source.

The existing procedural guidance already covers the administrator, credential, validation, activation, monitoring, and renewal handoffs. Changes address concrete visual ambiguities and the missing executable local-test starting point, rather than another broad rewrite. The final refinement preserves the original architecture assets and retains only new illustrations with a distinct purpose.

The accuracy review also corrected stale replacement-image captions/links, scoped the UML to a successful SMS example with endpoint error references, and made the certificate reuse action, unattended ID requirements, and EPP_DECRYPTION_KEY_PEM setting explicit. The user-facing app and full token exchange are outside this sample; the Function does not verify the user's entered code or grant app access. Voice UX is not assumed to match SMS.

Illustrations

The UML is an original, provider-neutral SVG with a PNG rendering and accessible description. It is a concrete example, not a live-run trace or claim that every sign-in uses SMS.

The two new portal screenshots were located in official documentation, visually inspected, and verified against exact public MicrosoftDocs/azure-docs blobs before inclusion:

• Function settings: source commit 1067858212cfae5f69de14fe53a3432eb461b052, image blob 6031c3b7512f28093a98550d89b68ffae3a913bf.
• Certificate version: source commit 22e0ade52c247e5d306a78dc9e392d901eb9c198, image blob 068a21f7dda41bb315f330769b4b9149e0b1a2c9. The pinned public source is used, not the different current Learn rendering.

The source revisions' LICENSE and ThirdPartyNotices.md explicitly license documentation/other content under CC BY 4.0; the image folders contain no asset-specific exception notices. Adjacent captions link the exact original asset, its instructional context, Microsoft copyright credit, and license. The screenshots are unmodified generic examples, not private tenant exports: Function values stay hidden; the certificate view contains public demo certificate metadata, not a private key. Instructions warn against copying demo names/expired dates, choosing the wrong identifier/current version, exporting keys, or copying generic host settings into FC1. No standalone NOTICE, permission banner, or approval claim is added.

The original architecture images are preserved, not replaced or deleted. Their existing schematic labels are not a literal delivery timeline or deployment template; the accompanying guidance states the applicable limits. The UML supplies the request ordering separately instead of adding another architecture overview.

Validation and limits

• Completed customer-flow/benefit, technical/source accuracy, and rendered readability/navigation checks.
• Rendered all 16 guides locally with the existing PowerShell Markdown renderer. Visually inspected the final affected sections, original architecture images, end-user UML, official screenshots, captions, and source links. Scalable SVG and clickable full-size screenshots provide larger views.
• Checked 441 local links, including 211 fragment targets, plus 17 image embeds: no missing targets or alt text. Existing image paths and document anchors are preserved.
• Verified original architecture PNG blob hashes against the base commit; neither image differs from base, and no original image is deleted.
• Parsed the three new command blocks as PowerShell and checked them against CI, package/test project paths, shared fixtures, and release packaging exclusions.
• Checked SVG structure and matching raster dimensions; git diff --check passes.
• Confirmed the general BYOT guide contains no fenced samples and no links to removed graphics remain. Visually rechecked runtime test instructions at narrow page width.
• Checked UML text bounds/overlap, arrows and parallel acceptance/delivery framing. Cross-checked SMS code entry and browser redirect against official Microsoft documentation, and endpoint/certificate/settings details against this repository's source.
• Verified both embedded screenshot hashes match the exact licensed public source blobs. Reviewed privacy, hidden values, field labels, copy controls, illustrative expired dates, and the warnings against private-key export or copying unrelated host settings.
• Cross-checked Front Door probe and caller-header behavior against the official Microsoft references already linked by the guide.
• Documentation/assets only: no runtime, script, settings, catalog, infrastructure, tenant, Azure deployment, or provider-send changes. No live usability/delivery claim. Runtime suites were not rerun; new official sources were checked, but the 97 previously existing external URLs were not exhaustively fetched. The local preview is not a pixel-identical GitHub renderer.

Base reviewed: ce68ee2649d8e4ab64e00c4abece33e939cdfa9c on upstream main.