Portfolio: record product and data boundaries in ADR 0002 #41

Part of #40.

Why

ADR 0001 says changes to account requirements and runtime boundaries need a later decision. Portfolios add public pages written by students, so record the decisions before building.

Decide and record in docs/decisions/0002-student-portfolios.md

• One portfolio per Google account. How a username is chosen, and whether it can change after publishing.
• Fixed fields only: no free HTML, CSS or JavaScript. The editor form and the Markdown import fill the same fields.
• Phase 1 public address: /u/<username>. Subdomains are Phase 2.
• The backend is the trusted validator; the frontend validates for feedback. Shared rules live in one place (for example shared/portfolio/), like shared/practice/questions.json.
• Personal data: no phone number or postal address; email is optional.
• States: draft, published, suspended. Search-engine visibility is opt-in.
• Age requirement for public portfolios. This needs the owner's decision; India's DPDP Act requires verifiable parental consent before processing a child's personal data.
• Moderation: how a page is reported and how an operator suspends it.

Done when

• The ADR is merged and linked from docs/architecture.md and docs/development.md.
• Questions that need the owner's decision are listed in the ADR.