Add branded default provider and enforced enrollment

src/SGU.AuthBroker/Options/BrokerOptions.cs

@@ -85,6 +85,11 @@ public sealed class BrokerOptions
         {
             throw new InvalidOperationException("RemoteDesktopGroupDn must identify a group beneath BaseDn.");
         }
+
+        if (string.IsNullOrWhiteSpace(Directory.DefaultCompany) || Directory.DefaultCompany.Length > 64)
+        {
+            throw new InvalidOperationException("DefaultCompany is required and must not exceed 64 characters.");
+        }
     }
 
     private static bool IsCertificateThumbprint(string value)
@@ -139,6 +144,8 @@ public sealed class ActiveDirectoryOptions
 
     public string RemoteDesktopGroupDn { get; init; } = string.Empty;
 
+    public string DefaultCompany { get; init; } = "Universidad La Salle";
+
     public bool CreateMissingOus { get; init; }
 
     public string GetOuDn(InstitutionalRole role) => role switch