Add student SGU profile synchronization

docs/architecture.md

@@ -21,10 +21,11 @@ which prevents credential forwarding to an unexpected redirect target. HTTP/1.1
 is forced because NTLM authentication is connection-bound.
 
 The logical GET is sent directly to the administrative incident overview for
-`AD` identities or to the portal menu for `DO`/`AL` identities. NTLM may still
-require its normal challenge/response round trips on that connection. The
-broker keeps any transient portal cookie in an in-memory per-request container;
-it is never persisted or returned to the client.
+`AD` identities, the student information page for `AL` identities, or the
+portal menu for `DO` identities. NTLM may still require its normal
+challenge/response round trips on that connection. The broker keeps any
+transient portal cookie in an in-memory per-request container; it is never
+persisted or returned to the client.
 
 ## Offline authentication
 
@@ -46,11 +47,13 @@ absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
 passes the submitted password directly to ADSI `SetPassword`.
 
 When the authenticated HTML exposes recognized stable IDs, the broker also
-updates `displayName`, `mail`, `title`, `department`, `employeeType`, and
-`employeeID`. The administrative employee number must match the six numeric
-digits of the requested `AD` identity before any scraped metadata is trusted.
-Missing metadata does not clear existing AD values and never changes the
-password outcome.
+updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
+`department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
+`postalCode` attributes. Administrative and student numbers must match the six
+numeric digits of the requested identity before any scraped metadata is
+trusted. Student faculty/department is deliberately left unset because the
+verified page does not expose it. Missing metadata does not clear existing AD
+values and never changes the password outcome.
 
 Human-readable SGU values are decoded with BOM/header/meta detection, strict
 UTF-8 validation, and a Windows-1252 fallback for the legacy portal. Names and