Add Azure user roaming and reproducible Laboratorio wallpaper policy

docs/architecture.md

@@ -78,6 +78,17 @@ is deliberately left unset because the verified page does not expose it.
 Missing metadata does not clear existing AD values and never changes the
 password outcome.
 
+## Azure user roaming
+
+Azure P2S deployments can add a dedicated, private Azure Files account. Student
+accounts (`AL`) keep a non-authoritative local profile and redirect only
+Documents/Desktop. Administrative and professor accounts (`AD`/`DO`) receive an
+FSLogix VHDX profile container through object-specific settings keyed to their
+AD security-group SIDs. The storage account uses AD DS Kerberos with AES-256;
+share-root ACLs use `CREATOR OWNER` so users cannot browse one another's data.
+The bootstrap staging account is deliberately separate. See
+[user-roaming.md](user-roaming.md) for rollout and recovery constraints.
+
 Every synchronization also enforces one idempotent security-group membership
 from the classified institutional prefix: `AL` to `SGU-Alumnos`, `AD` to
 `SGU-Administrativos`, and `DO` to `SGU-Docentes`. Each role group is stored