feat(bimi): hold the certificate, check the whole setup, serve the VMC

A Verified Mark Certificate cannot be made here: an authority issues it after
checking the organisation. What the service can do is hold the file the
authority returns, serve it where the DNS record points, and refuse one that
would make receivers ignore BIMI without a word.

- migration 0015: domain_bimi keeps the PEM chain next to the logo
- bimi.InspectCertificate reads a chain and reports every reason it would not
  work: private key blocks refused outright, the brand-indicator usage, the
  validity period, the domain (exact, wildcard or organisational), and that
  the logo embedded in the certificate (gzipped data URI in the logotype
  extension) is byte for byte the logo being published. Tested against two
  real public VMCs (eBay via DigiCert, CNN via Valimail) plus mutations
- GET /.well-known/bimi/vmc.pem (public, conditional, cacheable for an hour),
  and PUT/DELETE /api/v1/admin/bimi/certificate; the GET of the logo now
  reports the certificate as it stands against the logo being served, and
  replacing a logo under a held certificate says it no longer matches
- GET /api/v1/admin/bimi/check looks at what a receiver would: the logo, DMARC
  enforcement, the BIMI record, the public logo URL, the certificate and its
  public URL. Its HTTP client is HTTPS only and refuses non-public addresses
  after DNS, since the URLs come from DNS and an operator field
- the DNS record points a= at the held certificate when there is one

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/main.go

@@ -239,7 +239,7 @@ func run(cfg config) {
 	}
 	// The BIMI mark: served to receivers over the well-known URL, managed from
 	// the domains panel.
-	router.SetBimiAPI(bimiStore{postgres.NewBimiRepository(pool)}, cfg.JwtSecret, cfg.domain())
+	router.SetBimiAPI(bimiStore{postgres.NewBimiRepository(pool)}, cfg.JwtSecret, cfg.domain(), cfg.PrimaryMailHost)
 
 	// The TLS panel reads the live watcher instead of the constants the admin
 	// service used to return, which reported a healthy certificate whatever
@@ -722,7 +722,13 @@ func (s *dnsSpecSource) ExpectedRecords(ctx context.Context, domain string) ([]e
 	if s.bimi != nil {
 		if logo, err := s.bimi.Load(ctx, domain); err == nil && logo != nil {
 			spec.BimiLogoURL = httppresentation.BimiLogoURL(s.cfg.PrimaryMailHost)
-			spec.BimiVmcURL = logo.VmcURL
+			// The certificate held here wins: it is the one verified against the
+			// logo being served. An external URL is the fallback.
+			if len(logo.VmcPEM) > 0 {
+				spec.BimiVmcURL = httppresentation.BimiVmcURL(s.cfg.PrimaryMailHost)
+			} else {
+				spec.BimiVmcURL = logo.VmcURL
+			}
 		}
 	}