Prepare Azure P2S domain deployment

docs/security.md

@@ -1,5 +1,14 @@
 # Security model
 
+## Public Azure deployment
+
+Owning a public Azure IP does not make the domain controller an Internet-facing
+directory service. The supported cloud topology exposes no AD DS, DNS, SMB,
+RPC, WinRM, broker, monitoring, or RustDesk port publicly. Hyper-V and later
+physical Windows clients enter the VNet through certificate-authenticated Azure
+VPN Gateway P2S; the Azure NSG and Windows firewall accept the P2S pool and the
+private VNet only. See [azure-vpn-deployment.md](azure-vpn-deployment.md).
+
 ## Password handling
 
 - The Credential Provider receives the password in Lithnet's secure password
@@ -33,15 +42,18 @@
 - Administrative enrichment first verifies the employee number and reads
   employee type/status, email, job title, and department from the incident
   overview. Only after that match, it reads given names and paternal/maternal
-  surnames from the personal page plus street, exterior/interior number,
-  neighborhood, locality, state, and postal code from the location page.
-- Administrative birth date, RFC, CURP, sex, blood type, marital status,
+  surnames and the normalized `Male`/`Female` value from the personal page plus
+  street, exterior/interior number, neighborhood, locality, state, and postal
+  code from the location page. AD stores only the controlled `SGU-Gender` line,
+  not the original HTML field.
+- Administrative birth date, RFC, CURP, blood type, marital status,
   nationality, telephone, email lists, housing type, and emergency-contact
   fields are ignored.
 - Student enrichment reads only the matching student number, given names,
   paternal/maternal surnames, email, career, street, neighborhood,
-  city/municipality, state, and postal code from known element IDs.
-- Student CURP, birth date, sex, blood type, marital status, telephone, mobile,
+  city/municipality, state, postal code, and normalized sex from known element
+  IDs.
+- Student CURP, birth date, blood type, marital status, telephone, mobile,
   guardian, medical, financial, and academic-history values are ignored.
 - Professor enrichment keeps the menu display name as its base. From the payroll
   consultation header it reads only a matching employee number, name, email,