I ended up on Piwigo. It’s pretty fully featured and allows you to set up access controls for groups. Also has client apps.

Does it need to be “hosted”?

I like both these:

yEd (https://www.yworks.com/products/yed)

Dia Diagrams (http://dia-installer.de)

I think yEd had a free version but closed source.

“size… of a dinner plate” !!

Yeah. “Nation state”, “Sophisticated”, “command injection”… where have I heard this before?

Ahh, that’s right - with every breach where they had basic vulnerabilities exposed, or admin credentials compromised.

You might find some starting points or even projects or terms to look for in this article:

https://arstechnica.com/information-technology/2023/03/you-can-now-run-a-gpt-3-level-ai-model-on-your-laptop-phone-and-raspberry-pi/ .