docs(portal): declare DSAR ownership boundary

src/govoplan_portal/backend/manifest.py

@@ -231,6 +231,39 @@ manifest = ModuleManifest(
         ),
     },
     documentation=(
+        DocumentationTopic(
+            id="portal.data-subject-requests",
+            title="Portal data-subject request boundary",
+            summary="Understand why Portal has no separate privacy export and which authoritative modules own the projected data.",
+            body=(
+                "Portal persists no service-directory, service-launch, Postbox, application-status, applicant, or session records, so it deliberately publishes no duplicate data-subject request provider. Services owns definition attribution; Cases, Forms Runtime, and Workflow Engine own launch effects; Postbox owns mailbox records; and Forms Runtime owns submission and status-access data. Core and the deployment operator own authentication state, request/security logs, and infrastructure telemetry. "
+                "If durable personalization, analytics, saved searches, contact data, or sessions are added to Portal, a tenant-scoped privacy provider is required before release."
+            ),
+            layer="available",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            links=(
+                DocumentationLink(
+                    label="Portal ownership boundary",
+                    href="govoplan-portal/docs/SERVICE_DIRECTORY_CONCEPT.md",
+                    kind="repository",
+                ),
+            ),
+            related_modules=(
+                "core",
+                "services",
+                "cases",
+                "forms_runtime",
+                "workflow_engine",
+                "postbox",
+            ),
+            metadata={
+                "kind": "reference",
+                "help_contexts": ["portal.data-subject-requests"],
+                "dsar_coverage": "not_applicable_no_persistence",
+            },
+            order=10,
+        ),
         DocumentationTopic(
             id="portal.function-postboxes",
             title="Portal-facing function Postboxes",
@@ -337,6 +370,7 @@ manifest = ModuleManifest(
             "Portal does not persist service definitions; the Services provider remains authoritative.",
             "Case, Forms Runtime, and Workflow Engine own launch effects. Portal keeps entries unavailable whenever the selected owner capability is absent.",
             "Forms Runtime owns applicant-status access, redaction, and timeline semantics; Portal only presents that projection. Payment and decision-document actions are not yet included in the first status surface.",
+            "Portal owns no durable subject records and therefore has no DSAR provider; adding persistence requires introducing one before release.",
         ),
         owned_concepts=("service discovery", "service presentation", "channel entry", "applicant status presentation"),
         non_owned_concepts=("institutional service definition", "case lifecycle", "applicant status access decision"),