perf: convert all images to WebP with PDF fallback

Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction).
Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds
use WebP while PDF/LaTeX builds fall back to original PNG/JPG.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

5 files changed, 10 insertions, 10 deletions

diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst
index 9c360d35..fdf1179f 100644
--- a/docs/configuration/firewall/bridge.rst
+++ b/docs/configuration/firewall/bridge.rst
@@ -47,13 +47,13 @@ For traffic that needs to be switched internally by the bridge, base chain is
 **forward**, and it's base command for filtering is ``set firewall bridge
 forward filter ...``, which happens in stage 4, highlighted with red color.
 
-.. figure:: /_static/images/firewall-bridge-forward.png
+.. figure:: /_static/images/firewall-bridge-forward.*
 
 For traffic destined to the router itself, or that needs to be routed (assuming
 a layer3 bridge is configured), the base chain is **input**, the base command
 is ``set firewall bridge input filter ...`` and the path is:
 
-.. figure:: /_static/images/firewall-bridge-input.png
+.. figure:: /_static/images/firewall-bridge-input.*
 
 If it's not dropped, then the packet is sent to **IP Layer**, and will be
 processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again
@@ -64,7 +64,7 @@ And for traffic that originates from the bridge itself, the base chain is
 **output**, base command is ``set firewall bridge output filter ...``, and
 the path is:
 
-.. figure:: /_static/images/firewall-bridge-output.png
+.. figure:: /_static/images/firewall-bridge-output.*
 
 Custom bridge firewall chains can be created with the command ``set firewall bridge
 name <name> ...``. In order to use such custom chain, a rule with action jump,
diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst
index 915bf39d..35fb0add 100644
--- a/docs/configuration/firewall/flowtables.rst
+++ b/docs/configuration/firewall/flowtables.rst
@@ -34,7 +34,7 @@ Flowtables allow you to define a fastpath through the flowtable datapath.
 The flowtable supports for the layer 3 IPv4 and IPv6 and the layer 4 TCP
 and UDP protocols.
 
-.. figure:: /_static/images/firewall-flowtable-packet-flow.png
+.. figure:: /_static/images/firewall-flowtable-packet-flow.*
 
 Once the first packet of the flow successfully goes through the IP forwarding
 path (black circles path), from the second packet on, you might decide to
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index a5b88839..4fd9b208 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -20,7 +20,7 @@ A simplified traffic flow diagram, based on Netfilter packet flow, is shown
 next, in order to have a full view and understanding of how packets are 
 processed, and what possible paths traffic can take.
 
-.. figure:: /_static/images/firewall-gral-packet-flow.png
+.. figure:: /_static/images/firewall-gral-packet-flow.*
 
 The main points regarding this packet flow and terminology used in VyOS 
 firewall are covered below:
@@ -224,4 +224,4 @@ As the example image below shows, the device now needs rules to allow/block
 traffic to or from the services running on the device that have open
 connections on that interface.
 
-.. figure:: /_static/images/firewall-zonebased.png
+.. figure:: /_static/images/firewall-zonebased.*
diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst
index a9435fa8..4d54a68f 100644
--- a/docs/configuration/firewall/ipv4.rst
+++ b/docs/configuration/firewall/ipv4.rst
@@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. A simplified packet flow diagram for transit traffic is
 shown next:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain to configure filtering rules for transit traffic
 is ``set firewall ipv4 forward filter ...``, which happens in stage 5,
@@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path
 for traffic destined to the router itself, and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is ``set firewall ipv4 input
 filter ...``
diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst
index 95502f4a..905d0d20 100644
--- a/docs/configuration/firewall/ipv6.rst
+++ b/docs/configuration/firewall/ipv6.rst
@@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. A simplified packet flow diagram for transit traffic is
 shown next:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain to configure filtering rules for transit traffic
 is ``set firewall ipv6 forward filter ...``, which happens in stage 5,
@@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path
 for traffic destined to the router itself, and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is ``set firewall ipv6 input
 filter ...``