Implement user-engine portal foundation

docs/portal-threat-model.md

@@ -0,0 +1,49 @@
+# Portal boundary and threat model
+
+The portal is a transport adapter for user-engine, not a new identity
+authority. KeyCape owns login, credentials, MFA, authentication sessions and
+OIDC tokens. flex-auth owns authorization decisions. user-engine owns users,
+tenant memberships, profiles, registration, invitations, onboarding, audit
+records and lifecycle intent. NetKingdom implements `IdentityProvisioningPort`
+without leaking provider clients into the domain.
+
+## Trust boundaries
+
+- The public edge terminates TLS, rate-limits login/registration and validates
+  OIDC tokens. It strips all inbound `X-Verified-*` and
+  `X-User-Engine-Proxy-Secret` headers before injecting verified claims and
+  the runtime-only proxy marker.
+- user-engine rejects every protected route if that marker or verified claims
+  are absent. Direct pod traffic is blocked by NetworkPolicy.
+- Browser state is navigation state only. It is never authoritative for roles,
+  tenants, registration progress or lifecycle status.
+- Provider credentials come from approved runtime secret references. They do
+  not enter requests, logs, audit payloads, workplans or Git.
+
+## Controls
+
+Protected writes receive a flex-auth decision through the existing
+`AuthorizationCheckPort`. Tenant context is re-resolved in the service, so a
+tenant administrator cannot select another tenant. Mutations carry request
+correlation IDs and emit redacted audit/outbox records. Provisioning requests
+carry independent idempotency keys and support safe resume after ambiguity.
+
+The application emits a restrictive content security policy, prevents
+framing and MIME sniffing, disables sensitive response caching and escapes
+all server-rendered values. State-changing browser forms must use same-site
+cookies plus edge-issued CSRF tokens; the initial JSON API is intended for
+bearer-authenticated same-origin clients. Invitation tokens are single-use,
+hashed at rest, time-bound and rate-limited at both identity and address
+dimensions. Public errors must not reveal whether an email or tenant exists.
+
+Audit retention, identity erasure and external deprovisioning are distinct
+operations. Audit identifiers remain pseudonymous after erasure. Provider
+outage leaves a retryable outbox item and never reports the lifecycle change
+as externally complete. Compensation is idempotent and operator-visible.
+
+## Deferred
+
+Enterprise SAML/OIDC federation, SCIM and corporate directory synchronization
+remain provider adapters. Their external ownership metadata and identity links
+must fit the existing neutral boundaries rather than becoming user-engine
+domain dependencies.