Add student SGU profile synchronization

docs/architecture.md

@@ -21,10 +21,11 @@ which prevents credential forwarding to an unexpected redirect target. HTTP/1.1
 is forced because NTLM authentication is connection-bound.
 
 The logical GET is sent directly to the administrative incident overview for
-`AD` identities or to the portal menu for `DO`/`AL` identities. NTLM may still
-require its normal challenge/response round trips on that connection. The
-broker keeps any transient portal cookie in an in-memory per-request container;
-it is never persisted or returned to the client.
+`AD` identities, the student information page for `AL` identities, or the
+portal menu for `DO` identities. NTLM may still require its normal
+challenge/response round trips on that connection. The broker keeps any
+transient portal cookie in an in-memory per-request container; it is never
+persisted or returned to the client.
 
 ## Offline authentication
 
@@ -46,11 +47,13 @@ absent, moves it to the mapped OU when required, sets `userPrincipalName`, and
 passes the submitted password directly to ADSI `SetPassword`.
 
 When the authenticated HTML exposes recognized stable IDs, the broker also
-updates `displayName`, `mail`, `title`, `department`, `employeeType`, and
-`employeeID`. The administrative employee number must match the six numeric
-digits of the requested `AD` identity before any scraped metadata is trusted.
-Missing metadata does not clear existing AD values and never changes the
-password outcome.
+updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
+`department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
+`postalCode` attributes. Administrative and student numbers must match the six
+numeric digits of the requested identity before any scraped metadata is
+trusted. Student faculty/department is deliberately left unset because the
+verified page does not expose it. Missing metadata does not clear existing AD
+values and never changes the password outcome.
 
 Human-readable SGU values are decoded with BOM/header/meta detection, strict
 UTF-8 validation, and a Windows-1252 fallback for the legacy portal. Names and

docs/broker-operations.md

@@ -46,10 +46,11 @@ Eso es comportamiento esperado, no una caída del servicio.
 
 ## Timeouts y recuperación
 
-- El Credential Provider espera hasta **20 segundos** por el broker.
-- El broker espera hasta **15 segundos** por SGU. Un portal que normalmente
-  tarda alrededor de seis segundos queda dentro del margen sin bloquear LogonUI
-  indefinidamente.
+- El Credential Provider espera hasta **35 segundos** por el broker.
+- El broker espera hasta **30 segundos** por SGU. Este margen cubre las
+  degradaciones observadas del portal sin bloquear LogonUI indefinidamente; el
+  cliente conserva cinco segundos adicionales para que el broker cierre la
+  respuesta de manera limpia.
 - El instalador configura recuperación del servicio con reinicios a los 5, 15
   y 60 segundos y reinicia el contador de fallos después de 24 horas.
 - Si el broker o SGU no está disponible, el Credential Provider entrega la

docs/lab-runbook.md

@@ -124,7 +124,7 @@ On Windows 10:
   -BrokerEndpoint https://sgu-auth.lci.lasalle.mx:8443/v1/authenticate `
   -ClientCertificateThumbprint CLIENT_CERT_THUMBPRINT `
   -ServerCertificateThumbprint SERVER_CERT_THUMBPRINT `
-  -TimeoutSeconds 20 `
+  -TimeoutSeconds 35 `
   -InstallDotNetRuntime `
   -DotNetRuntimeInstallerPath C:\SGUDeploy\prerequisites\dotnet-runtime-10.0.11-win-x64.exe
 ```

docs/security.md

@@ -32,10 +32,15 @@
 
 - Administrative enrichment reads only employee number, display name,
   employee type/status, email, job title, and department from known element IDs.
+- Student enrichment reads only the matching student number, given names,
+  paternal/maternal surnames, email, career, street, neighborhood,
+  city/municipality, state, and postal code from known element IDs.
+- Student CURP, birth date, sex, blood type, marital status, telephone, mobile,
+  guardian, medical, financial, and academic-history values are ignored.
 - Incident details, calendars, photographs, manager names, and manager positions
   are deliberately ignored.
-- The employee number must match the authenticated `AD` key before metadata is
-  synchronized.
+- The employee or student number must match the authenticated `AD` or `AL` key
+  before metadata is synchronized.
 - If SGU changes its HTML, authentication and exact-password synchronization
   continue without enrichment; existing AD metadata is not erased.
 

docs/windows-client-onboarding.md

@@ -82,7 +82,7 @@ powershell.exe -NoProfile -ExecutionPolicy Bypass `
   -BrokerEndpoint https://sgu-auth.lci.lasalle.mx:8443/v1/authenticate `
   -ClientCertificateThumbprint CLIENT_CERT_THUMBPRINT `
   -ServerCertificateThumbprint SERVER_CERT_THUMBPRINT `
-  -TimeoutSeconds 20
+  -TimeoutSeconds 35
 ```
 
 Los binarios se guardan en un subdirectorio `versions` identificado por su