Adapt welcome wallpaper to SGU gender

docs/architecture.md

@@ -27,8 +27,8 @@ accepted it. The broker then makes separately bounded, best-effort profile GETs.
 It uses the administrative incident overview for `AD`, the student information
 page for `AL`, and the portal menu as a conservative base for `DO`. After the
 incident page confirms an `AD` employee number, two additional GETs in the same
-in-memory session read the structured name from `datos/personales.aspx` and the
-address from `datos/ubicacion.aspx`. Docentes request
+in-memory session read the structured name and selected sex from
+`datos/personales.aspx` and the address from `datos/ubicacion.aspx`. Docentes request
 `nomina/consultanomina.aspx` for a matching employee number, email, employee
 type and job title, then attempt the same two shared staff modules without
 requiring any optional route to exist. A supplemental
@@ -61,7 +61,9 @@ passes the submitted password directly to ADSI `SetPassword`.
 When the authenticated HTML exposes recognized stable IDs, the broker also
 updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
-`postalCode` attributes. Administrative and student numbers must match the six
+`postalCode` attributes. The SGU sex value is normalized to `Male`/`Female` and
+written as the managed `SGU-Gender:` line in the built-in `info` attribute while
+preserving unrelated notes. Administrative and student numbers must match the six
 numeric digits of the requested identity before any role-specific metadata is
 trusted. Administrative personal and location pages are accepted only after
 that incident-page match. Docente payroll metadata must match the requested
@@ -118,6 +120,9 @@ settings for managed clients.
 
 That computer GPO also owns the base lock-screen image and a per-logon command
 for the personalized desktop wallpaper. The client-side renderer reads the
+managed `SGU-Gender: Male|Female` line from the user's built-in `info` attribute
+(without requiring an irreversible AD schema extension). It uses neutral Spanish
+when that optional enrichment is unavailable. The renderer also reads the
 authenticated user's `displayName` plus the computer object's `location` and
 immediate parent OU, then composes those values over the bundled dark-blue
 background with the bundled Indivisa fonts. Missing directory attributes degrade

docs/welcome-wallpaper.md

@@ -16,14 +16,20 @@ El generador consulta Active Directory con la identidad ya autenticada y sin
 guardar credenciales. Obtiene:
 
 - `displayName` del usuario; si falta, utiliza `sAMAccountName`.
+- La línea administrada `SGU-Gender: Male|Female` del atributo `info`; el Auth
+  Broker la obtiene del SGU y conserva cualquier otra nota que ya exista.
 - `location` del objeto de equipo.
 - La OU padre inmediata a partir de `distinguishedName`.
 
-El texto secundario sigue estas reglas:
+El saludo usa `Bienvenido/ubicado` para `Male` y `Bienvenida/ubicada` para
+`Female`. Cuando el enriquecimiento no produjo este dato, utiliza la redacción
+neutral `Te damos la bienvenida` y `Ubicación:`. El texto secundario sigue estas
+reglas:
 
 1. Con `location` y OU: `Estás ubicado en la Sala de Inmersión del Centro de Experiencia Digital.`
 2. Con sólo uno de los datos: muestra únicamente el dato disponible.
-3. Sin ambos: `Bienvenido al Laboratorio de Cómputo de Ingeniería.`
+3. Sin ambos: el texto adaptado `Bienvenido/Bienvenida al Laboratorio...`; sin
+   sexo disponible, la forma neutral `Acceso al Laboratorio de Cómputo de Ingeniería.`
 
 La ausencia de AD, de un atributo o de una tipografía nunca bloquea la sesión.
 Los errores de generación se registran en