I ended up on Piwigo. It’s pretty fully featured and allows you to set up access controls for groups. Also has client apps.

These are fully stand alone. Downloadable. So not strictly hosted I guess?

Does it need to be “hosted”?

I like both these:

yEd (https://www.yworks.com/products/yed)

Dia Diagrams (http://dia-installer.de)

I think yEd had a free version but closed source.

“size… of a dinner plate” !!

Yeah. “Nation state”, “Sophisticated”, “command injection”… where have I heard this before?

Ahh, that’s right - with every breach where they had basic vulnerabilities exposed, or admin credentials compromised.