Add student SGU profile synchronization

README.md

@@ -16,7 +16,7 @@ Directory synchronization, deployment scripts, and tests.
    NTLM endpoint. The same logical authenticated request reads the minimum
    available SGU profile fields.
 4. On success, the broker creates or moves the AD user, updates the available
-   name/mail/title/department metadata, and sets the AD password
+   name/mail/title/department/address metadata when available, and sets the AD password
    to the exact submitted password.
 5. The Credential Provider serializes the original `SecureString` to Windows.
 
@@ -26,10 +26,13 @@ event log, application log, command line, or response.
 For administrative accounts, profile enrichment targets the read-only incident
 overview and reads only the employee number, name, account type/status, email,
 job title, and department from their stable element IDs. Incident, calendar,
-photo, and manager fields are ignored. For students and professors, the menu
-display name is a conservative fallback until a richer role-specific page is
-verified. Missing or changed presentation HTML never blocks authentication or
-password synchronization.
+photo, and manager fields are ignored. Student enrichment targets the read-only
+student information page and reads only the matching student number, structured
+name, email, career, and postal address. The career becomes an AD title in the
+form `Estudiante de ...`; faculty/department remains unset because the verified
+page does not expose it. Professors retain the menu display-name fallback until
+a richer role-specific page is verified. Missing or changed presentation HTML
+never blocks authentication or password synchronization.
 
 Operational documentation: