feat(bimi): hold the certificate, check the whole setup, serve the VMC

A Verified Mark Certificate cannot be made here: an authority issues it after
checking the organisation. What the service can do is hold the file the
authority returns, serve it where the DNS record points, and refuse one that
would make receivers ignore BIMI without a word.

- migration 0015: domain_bimi keeps the PEM chain next to the logo
- bimi.InspectCertificate reads a chain and reports every reason it would not
  work: private key blocks refused outright, the brand-indicator usage, the
  validity period, the domain (exact, wildcard or organisational), and that
  the logo embedded in the certificate (gzipped data URI in the logotype
  extension) is byte for byte the logo being published. Tested against two
  real public VMCs (eBay via DigiCert, CNN via Valimail) plus mutations
- GET /.well-known/bimi/vmc.pem (public, conditional, cacheable for an hour),
  and PUT/DELETE /api/v1/admin/bimi/certificate; the GET of the logo now
  reports the certificate as it stands against the logo being served, and
  replacing a logo under a held certificate says it no longer matches
- GET /api/v1/admin/bimi/check looks at what a receiver would: the logo, DMARC
  enforcement, the BIMI record, the public logo URL, the certificate and its
  public URL. Its HTTP client is HTTPS only and refuses non-public addresses
  after DNS, since the URLs come from DNS and an operator field
- the DNS record points a= at the held certificate when there is one

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

migrations/0015_bimi_certificate.up.sql

@@ -0,0 +1,17 @@
+-- The BIMI certificate a domain publishes, held here instead of only linked.
+--
+-- A Verified Mark Certificate is issued by an authority after it has checked
+-- the organisation, so it cannot be generated here; but the authority hands
+-- back a .pem file, and until now the console only took a URL to one hosted
+-- somewhere else. Holding the file lets the service serve it at
+-- /.well-known/bimi/vmc.pem and point the DNS record there, next to the logo
+-- the certificate was issued for.
+--
+-- Stored as the PEM chain exactly as delivered. Everything the console shows
+-- about it (validity, subject, whether it matches the logo) is read from the
+-- file when asked, so it cannot drift from what is actually served.
+--
+-- vmc_url stays: a domain may keep its certificate with the authority.
+ALTER TABLE domain_bimi
+    ADD COLUMN IF NOT EXISTS vmc_pem         BYTEA,
+    ADD COLUMN IF NOT EXISTS vmc_uploaded_at TIMESTAMPTZ;