Enrich AD users from SGU profile metadata

docs/architecture.md

@@ -8,7 +8,8 @@ LogonUI
       -> HTTPS 1.1 + client certificate
           -> SGU Auth Broker
               -> SGU IIS NTLM endpoint (original password)
-              -> Active Directory (same original password)
+              -> minimum SGU profile metadata (same authenticated response)
+              -> Active Directory (same original password + optional profile)
           <- domain + canonical username; never a password
       -> Windows credential serialization (original SecureString)
   -> LSA / Kerberos / cached domain logon
@@ -19,6 +20,12 @@ It follows only HTTPS redirects whose host appears in `AllowedRedirectHosts`,
 which prevents credential forwarding to an unexpected redirect target. HTTP/1.1
 is forced because NTLM authentication is connection-bound.
 
+The logical GET is sent directly to the administrative incident overview for
+`AD` identities or to the portal menu for `DO`/`AL` identities. NTLM may still
+require its normal challenge/response round trips on that connection. The
+broker keeps any transient portal cookie in an in-memory per-request container;
+it is never persisted or returned to the client.
+
 ## Offline authentication
 
 ```text
@@ -38,6 +45,13 @@ plus six digits. It searches `BaseDn` by `sAMAccountName`, creates the user when
 absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
 passes the submitted password directly to ADSI `SetPassword`.
 
+When the authenticated HTML exposes recognized stable IDs, the broker also
+updates `displayName`, `mail`, `title`, `department`, `employeeType`, and
+`employeeID`. The administrative employee number must match the six numeric
+digits of the requested `AD` identity before any scraped metadata is trusted.
+Missing metadata does not clear existing AD values and never changes the
+password outcome.
+
 The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
 and `Administrativos` are direct child OUs beneath it.