docs: add Mermaid diagrams throughout docs

- plan.md: architecture flow diagram
- README.md: simple forwarder overview diagram
- story.md: DNS censorship and SOCKS5 proxy diagrams
- intra-comparison.md: all ASCII diagrams converted to Mermaid

docs/story.md

@@ -10,6 +10,18 @@ port 53) and:
 - Log every domain you look up
 - Inject ads or redirect to government portals
 
+```mermaid
+sequenceDiagram
+    participant User
+    participant ISP as ISP DNS
+    participant Real as Real Server
+
+    User->>ISP: youtube.com?
+    ISP-->>User: 1.2.3.4 (FAKE IP)
+    User->>Real: HTTPS to 1.2.3.4
+    Real-->>User: ❌ Connection failed / redirected
+```
+
 DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) solve this by encrypting DNS
 queries, making them invisible to the ISP's DNS layer.
 
@@ -48,6 +60,17 @@ A local forwarder that sends `POST https://cloudflare-dns.com/dns-query` will
 work in most of the world, but **will likely fail in Iran** because the
 connection to Cloudflare itself is blocked.
 
+```mermaid
+sequenceDiagram
+    participant Client
+    participant FW as Firewall / DPI
+    participant CF as Cloudflare DoH
+
+    Client->>FW: POST https://cloudflare-dns.com/dns-query
+    FW->>FW: Inspect SNI: cloudflare-dns.com
+    FW-->>Client: ❌ BLOCKED (connection reset)
+```
+
 ## What Actually Works in Censored Environments
 
 Tools that solve the **upstream blocking** problem:
@@ -86,8 +109,14 @@ Route upstream DoH traffic through a proxy (SOCKS5, HTTP CONNECT, or
 WireGuard tunnel) instead of direct HTTPS. This bypasses SNI and IP
 blocking:
 
-```
-Local DNS → this forwarder → SOCKS5 proxy → DoH resolver
+```mermaid
+flowchart LR
+    client["DNS Client"] -- "UDP/TCP" --> forwarder["doh-forwarder"]
+    forwarder -- "SOCKS5/CONNECT" --> proxy["Proxy Server"]
+    proxy -- "HTTPS" --> doh["DoH Resolver"]
+    doh -- "DNS response" --> proxy
+    proxy -- "DNS response" --> forwarder
+    forwarder -- "DNS response" --> client
 ```
 
 No existing lightweight Rust tool does this well. `dnscrypt-proxy` has