perf: convert all images to WebP with PDF fallback

Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction).
Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds
use WebP while PDF/LaTeX builds fall back to original PNG/JPG.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

20 files changed, 29 insertions, 29 deletions

diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst
index 9c360d35..fdf1179f 100644
--- a/docs/configuration/firewall/bridge.rst
+++ b/docs/configuration/firewall/bridge.rst
@@ -47,13 +47,13 @@ For traffic that needs to be switched internally by the bridge, base chain is
 **forward**, and it's base command for filtering is ``set firewall bridge
 forward filter ...``, which happens in stage 4, highlighted with red color.
 
-.. figure:: /_static/images/firewall-bridge-forward.png
+.. figure:: /_static/images/firewall-bridge-forward.*
 
 For traffic destined to the router itself, or that needs to be routed (assuming
 a layer3 bridge is configured), the base chain is **input**, the base command
 is ``set firewall bridge input filter ...`` and the path is:
 
-.. figure:: /_static/images/firewall-bridge-input.png
+.. figure:: /_static/images/firewall-bridge-input.*
 
 If it's not dropped, then the packet is sent to **IP Layer**, and will be
 processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again
@@ -64,7 +64,7 @@ And for traffic that originates from the bridge itself, the base chain is
 **output**, base command is ``set firewall bridge output filter ...``, and
 the path is:
 
-.. figure:: /_static/images/firewall-bridge-output.png
+.. figure:: /_static/images/firewall-bridge-output.*
 
 Custom bridge firewall chains can be created with the command ``set firewall bridge
 name <name> ...``. In order to use such custom chain, a rule with action jump,
diff --git a/docs/configuration/firewall/flowtables.rst b/docs/configuration/firewall/flowtables.rst
index 915bf39d..35fb0add 100644
--- a/docs/configuration/firewall/flowtables.rst
+++ b/docs/configuration/firewall/flowtables.rst
@@ -34,7 +34,7 @@ Flowtables allow you to define a fastpath through the flowtable datapath.
 The flowtable supports for the layer 3 IPv4 and IPv6 and the layer 4 TCP
 and UDP protocols.
 
-.. figure:: /_static/images/firewall-flowtable-packet-flow.png
+.. figure:: /_static/images/firewall-flowtable-packet-flow.*
 
 Once the first packet of the flow successfully goes through the IP forwarding
 path (black circles path), from the second packet on, you might decide to
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index a5b88839..4fd9b208 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -20,7 +20,7 @@ A simplified traffic flow diagram, based on Netfilter packet flow, is shown
 next, in order to have a full view and understanding of how packets are 
 processed, and what possible paths traffic can take.
 
-.. figure:: /_static/images/firewall-gral-packet-flow.png
+.. figure:: /_static/images/firewall-gral-packet-flow.*
 
 The main points regarding this packet flow and terminology used in VyOS 
 firewall are covered below:
@@ -224,4 +224,4 @@ As the example image below shows, the device now needs rules to allow/block
 traffic to or from the services running on the device that have open
 connections on that interface.
 
-.. figure:: /_static/images/firewall-zonebased.png
+.. figure:: /_static/images/firewall-zonebased.*
diff --git a/docs/configuration/firewall/ipv4.rst b/docs/configuration/firewall/ipv4.rst
index a9435fa8..4d54a68f 100644
--- a/docs/configuration/firewall/ipv4.rst
+++ b/docs/configuration/firewall/ipv4.rst
@@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. A simplified packet flow diagram for transit traffic is
 shown next:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain to configure filtering rules for transit traffic
 is ``set firewall ipv4 forward filter ...``, which happens in stage 5,
@@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path
 for traffic destined to the router itself, and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is ``set firewall ipv4 input
 filter ...``
diff --git a/docs/configuration/firewall/ipv6.rst b/docs/configuration/firewall/ipv6.rst
index 95502f4a..905d0d20 100644
--- a/docs/configuration/firewall/ipv6.rst
+++ b/docs/configuration/firewall/ipv6.rst
@@ -55,7 +55,7 @@ For transit traffic, which is received by the router and forwarded, the base
 chain is **forward**. A simplified packet flow diagram for transit traffic is
 shown next:
 
-.. figure:: /_static/images/firewall-fwd-packet-flow.png
+.. figure:: /_static/images/firewall-fwd-packet-flow.*
 
 The base firewall chain to configure filtering rules for transit traffic
 is ``set firewall ipv6 forward filter ...``, which happens in stage 5,
@@ -67,7 +67,7 @@ A new simplified packet flow diagram is shown next, which shows the path
 for traffic destined to the router itself, and traffic generated by the
 router (starting from circle number 6):
 
-.. figure:: /_static/images/firewall-input-packet-flow.png
+.. figure:: /_static/images/firewall-input-packet-flow.*
 
 The base chain for traffic towards the router is ``set firewall ipv6 input
 filter ...``
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index e0a374c3..187720a9 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -536,7 +536,7 @@ between the two devices.
 
 Let's assume the following topology:
 
-.. figure:: /_static/images/vyos_arista_bond_lacp.png
+.. figure:: /_static/images/vyos_arista_bond_lacp.*
    :alt: VyOS Arista EOS setup
 
 **R1**
diff --git a/docs/configuration/interfaces/openvpn-examples.rst b/docs/configuration/interfaces/openvpn-examples.rst
index 46409975..bba04d9c 100644
--- a/docs/configuration/interfaces/openvpn-examples.rst
+++ b/docs/configuration/interfaces/openvpn-examples.rst
@@ -34,7 +34,7 @@ In both cases, we will use the following settings:
   router has a dynamic IP address.
 
 
-.. figure:: /_static/images/openvpn_site2site_diagram.jpg
+.. figure:: /_static/images/openvpn_site2site_diagram.*
 
 Set up site-to-site certificates
 --------------------------------
diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst
index 1f7c875f..e66b0fb8 100644
--- a/docs/configuration/interfaces/wireguard.rst
+++ b/docs/configuration/interfaces/wireguard.rst
@@ -16,7 +16,7 @@ Site-to-site VPN
 
 The following diagram illustrates a site-to-site VPN setup.
 
-.. figure:: /_static/images/wireguard_site2site_diagram.jpg
+.. figure:: /_static/images/wireguard_site2site_diagram.*
 
 ********
 Keypairs
@@ -425,7 +425,7 @@ simplify deployment, generate a per-mobile configuration from the VyOS CLI.
   to. The address parameter can be used twice to assign both an IPv4 (/32) and 
   an IPv6 (/128) address to the client.
 
-  .. figure:: /_static/images/wireguard_qrcode.jpg
+  .. figure:: /_static/images/wireguard_qrcode.*
      :alt: WireGuard Client QR code
 
 .. stop_vyoslinter
diff --git a/docs/configuration/loadbalancing/wan.rst b/docs/configuration/loadbalancing/wan.rst
index 745cd8c2..b376f4fb 100644
--- a/docs/configuration/loadbalancing/wan.rst
+++ b/docs/configuration/loadbalancing/wan.rst
@@ -201,7 +201,7 @@ Sticky Connections
 Inbound connections to a WAN interface can be improperly handled when the reply
 is sent back to the client.
 
-.. image:: /_static/images/sticky-connections.jpg
+.. image:: /_static/images/sticky-connections.*
    :width: 80%
    :align: center
 
diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst
index fb0d5af9..63b787ba 100644
--- a/docs/configuration/nat/nat44.rst
+++ b/docs/configuration/nat/nat44.rst
@@ -692,7 +692,7 @@ The ASP requests that all connections from this company should come from
 172.29.41.89 - an address that is assigned by the ASP and not in use at
 the customer site.
 
-.. figure:: /_static/images/nat_before_vpn_topology.png
+.. figure:: /_static/images/nat_before_vpn_topology.*
    :scale: 100 %
    :alt: NAT before VPN Topology
 
diff --git a/docs/configuration/nat/nat66.rst b/docs/configuration/nat/nat66.rst
index 42f63fc9..31f6c002 100644
--- a/docs/configuration/nat/nat66.rst
+++ b/docs/configuration/nat/nat66.rst
@@ -124,7 +124,7 @@ Use the following topology to build a nat66 based isolated
 network between internal and external networks (dynamic prefix is 
 not supported):
 
-.. figure:: /_static/images/vyos_1_4_nat66_simple.png
+.. figure:: /_static/images/vyos_1_4_nat66_simple.*
    :alt: VyOS NAT66 Simple Configure
 
 R1:
@@ -154,7 +154,7 @@ R2:
 Use the following topology to translate internal user local addresses (``fc::/7``)
 to DHCPv6-PD provided prefixes from an ISP connected to a VyOS HA pair.
 
-.. figure:: /_static/images/vyos_1_5_nat66_dhcpv6_wdummy.png
+.. figure:: /_static/images/vyos_1_5_nat66_dhcpv6_wdummy.*
    :alt: VyOS NAT66 DHCPv6 using a dummy interface
 
 Configure both routers (a and b) for DHCPv6-PD via dummy interface:
diff --git a/docs/configuration/policy/examples.rst b/docs/configuration/policy/examples.rst
index d822d839..6c5c592a 100644
--- a/docs/configuration/policy/examples.rst
+++ b/docs/configuration/policy/examples.rst
@@ -99,7 +99,7 @@ Routing tables that will be used in this example are:
 * ``main`` Routing table used by VyOS and other interfaces not
   participating in PBR
 
-.. figure:: /_static/images/pbr_example_1.png
+.. figure:: /_static/images/pbr_example_1.*
    :scale: 80 %
    :alt: PBR multiple uplinks
 
diff --git a/docs/configuration/protocols/pim.rst b/docs/configuration/protocols/pim.rst
index 2e881943..019f1e64 100644
--- a/docs/configuration/protocols/pim.rst
+++ b/docs/configuration/protocols/pim.rst
@@ -218,7 +218,7 @@ Example
 
 In the following example we can see a basic multicast setup:
 
-.. image:: /_static/images/multicast-basic.png
+.. image:: /_static/images/multicast-basic.*
    :width: 90%
    :align: center
    :alt: Network Topology Diagram
diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst
index 232db1a8..08b71eed 100644
--- a/docs/configuration/service/conntrack-sync.rst
+++ b/docs/configuration/service/conntrack-sync.rst
@@ -196,7 +196,7 @@ Example
 
 The next example is a simple configuration of conntrack-sync.
 
-.. figure:: /_static/images/service_conntrack_sync-schema.png
+.. figure:: /_static/images/service_conntrack_sync-schema.*
    :scale: 60 %
    :alt: Conntrack Sync Example
 
diff --git a/docs/configuration/service/dhcp-relay.rst b/docs/configuration/service/dhcp-relay.rst
index 632b2800..6a1b02f2 100644
--- a/docs/configuration/service/dhcp-relay.rst
+++ b/docs/configuration/service/dhcp-relay.rst
@@ -89,7 +89,7 @@ Example
 * Router receives DHCP client requests on ``eth1`` and relays them to the
   server at 10.0.1.4 on ``eth2``.
 
-.. figure:: /_static/images/service_dhcp-relay01.png
+.. figure:: /_static/images/service_dhcp-relay01.*
    :scale: 80 %
    :alt: DHCP relay example
 
@@ -177,7 +177,7 @@ Example
 * Requests are forwarded through ``eth2`` as the `upstream interface`
 * External DHCPv6 server is at 2001:db8::4
 
-.. figure:: /_static/images/service_dhcpv6-relay01.png
+.. figure:: /_static/images/service_dhcpv6-relay01.*
    :scale: 80 %
    :alt: DHCPv6 relay example
 
diff --git a/docs/configuration/service/snmp.rst b/docs/configuration/service/snmp.rst
index b444ab85..6dc13240 100644
--- a/docs/configuration/service/snmp.rst
+++ b/docs/configuration/service/snmp.rst
@@ -56,7 +56,7 @@ managed devices. NMSs provide the bulk of the processing and memory resources
 required for network management. One or more NMSs may exist on any managed
 network.
 
-.. figure:: /_static/images/service_snmp_communication_principles_diagram.png
+.. figure:: /_static/images/service_snmp_communication_principles_diagram.*
    :scale: 20 %
    :alt: Principle of SNMP Communication
 
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
index 59f5af1e..dc796fe8 100644
--- a/docs/configuration/vpn/dmvpn.rst
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -27,7 +27,7 @@ peers.
    complete solution also incorporates the use of a routing protocol. BGP is
    particularly well suited for use with DMVPN.
 
-.. figure:: /_static/images/vpn_dmvpn_topology01.png
+.. figure:: /_static/images/vpn_dmvpn_topology01.*
    :scale: 40 %
    :alt: Baseline DMVPN topology
 
@@ -195,7 +195,7 @@ Example
 This blueprint uses VyOS as the DMVPN Hub and Cisco IOSv 15.5(3)M and VyOS as
 multiple spoke sites.
 
-.. figure:: /_static/images/blueprint-dmvpn.png
+.. figure:: /_static/images/blueprint-dmvpn.*
    :width: 70%
    :align: center
    :alt: DMVPN Network Topology Diagram
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.rst b/docs/configuration/vpn/ipsec/ipsec_general.rst
index 873f4f51..a9a1eb0f 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.rst
+++ b/docs/configuration/vpn/ipsec/ipsec_general.rst
@@ -32,7 +32,7 @@ There are two IPsec modes:
         another IP datagram, and an IPsec header (AH or ESP) is
         inserted between the outer and inner headers.
 
-.. figure:: /_static/images/ESP_AH.png
+.. figure:: /_static/images/ESP_AH.*
    :scale: 80 %
    :alt: AH and ESP in Transport Mode and Tunnel Mode
 
diff --git a/docs/configuration/vpn/ipsec/site2site_ipsec.rst b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
index 227621ac..628b8e9d 100644
--- a/docs/configuration/vpn/ipsec/site2site_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/site2site_ipsec.rst
@@ -184,7 +184,7 @@ The result of wrong value selection can be unstable work of the VPN.
 Below flow-chart could be a quick reference for the close-action
 combination depending on how the peer is configured.
 
-.. figure:: /_static/images/IPSec_close_action_settings.png
+.. figure:: /_static/images/IPSec_close_action_settings.*
 
 Similar combinations are applicable for the dead-peer-detection.
 
diff --git a/docs/configuration/vrf/index.rst b/docs/configuration/vrf/index.rst
index f41e98a2..d8b81bac 100644
--- a/docs/configuration/vrf/index.rst
+++ b/docs/configuration/vrf/index.rst
@@ -272,7 +272,7 @@ VRF route leaking
 
 The following example topology was built using EVE-NG.
 
-.. figure:: /_static/images/vrf-example-topology-01.png
+.. figure:: /_static/images/vrf-example-topology-01.*
    :alt: VRF topology example
 
    VRF route leaking