Expand portal onboarding and administration

docs/configuration.md

@@ -42,3 +42,17 @@ Initial logical names:
 - Sensitive writes must fail closed when authorization is unavailable.
 - Claims enrichment must be optional and must not make user-engine a token
   issuer.
+
+## Portal integration settings
+
+The production portal requires its existing database, OIDC, proxy-marker, and
+identity-provisioning settings. Platform tenant creation is enabled only when
+both of these settings are present:
+
+- `USER_ENGINE_TENANT_MANAGEMENT_URL` — tenant-authority base URL;
+- `USER_ENGINE_TENANT_MANAGEMENT_TOKEN` — workload-scoped bearer token.
+
+The adapter calls `POST /v1/tenants` with correlation and idempotency headers.
+The token is never returned in errors, audit records, outbox events, or browser
+responses. When the settings are absent, ordinary portal behavior remains
+available and platform tenant creation fails closed as unavailable.