Add Tech Notes section under Enterprise with LLM key protection article

docs.json

@@ -435,6 +435,13 @@
               "enterprise/k8s-install/index",
               "enterprise/k8s-install/resource-limits"
             ]
+          },
+          {
+            "group": "Tech Notes",
+            "pages": [
+              "enterprise/tech-notes/index",
+              "enterprise/tech-notes/llm-key-protection"
+            ]
           }
         ]
       }

enterprise/tech-notes/images/llm-key-architecture.d2

@@ -0,0 +1,110 @@
+direction: down
+
+title: LLM API Key Protection Architecture {
+  near: top-center
+  shape: text
+  style: {
+    font-size: 24
+    bold: true
+  }
+}
+
+agent-server: Agent Server (Python Process) {
+  style: {
+    fill: "#f8fafc"
+    stroke: "#94a3b8"
+    border-radius: 12
+  }
+
+  agent-loop: Agent Loop {
+    style: {
+      fill: "#eef2ff"
+      stroke: "#6366f1"
+      border-radius: 8
+    }
+  }
+
+  llm: LLM\n(api_key 🔑) {
+    style: {
+      fill: "#fef3c7"
+      stroke: "#f59e0b"
+      border-radius: 8
+      font-color: "#92400e"
+    }
+  }
+
+  provider-api: LiteLLM / Provider API {
+    style: {
+      fill: "#ecfdf5"
+      stroke: "#10b981"
+      border-radius: 8
+    }
+  }
+
+  agent-loop -> llm: {
+    style: {
+      stroke: "#6366f1"
+      stroke-width: 2
+    }
+  }
+
+  llm -> provider-api: {
+    style: {
+      stroke: "#6366f1"
+      stroke-width: 2
+    }
+  }
+
+  sandbox: Sandbox Environment (Isolated Container) {
+    style: {
+      fill: "#fef2f2"
+      stroke: "#ef4444"
+      stroke-dash: 5
+      border-radius: 10
+    }
+
+    bash: Bash Commands {
+      style: {
+        fill: "#ffffff"
+        stroke: "#d1d5db"
+        border-radius: 6
+      }
+    }
+
+    files: File Editor {
+      style: {
+        fill: "#ffffff"
+        stroke: "#d1d5db"
+        border-radius: 6
+      }
+    }
+
+    tools: Other Tools {
+      style: {
+        fill: "#ffffff"
+        stroke: "#d1d5db"
+        border-radius: 6
+      }
+    }
+
+    no-access: |md
+      ❌ No LLM_API_KEY
+      ❌ No SESSION_API_KEY
+      ❌ No Provider Credentials
+    | {
+      style: {
+        fill: "#fee2e2"
+        stroke: "#fecaca"
+        border-radius: 6
+        font-color: "#991b1b"
+      }
+    }
+  }
+
+  agent-loop -> sandbox: Tool calls\n(no secrets) {
+    style: {
+      stroke: "#9ca3af"
+      stroke-width: 2
+    }
+  }
+}