feat(bimi): hold the certificate, check the whole setup, serve the VMC

A Verified Mark Certificate cannot be made here: an authority issues it after
checking the organisation. What the service can do is hold the file the
authority returns, serve it where the DNS record points, and refuse one that
would make receivers ignore BIMI without a word.

- migration 0015: domain_bimi keeps the PEM chain next to the logo
- bimi.InspectCertificate reads a chain and reports every reason it would not
  work: private key blocks refused outright, the brand-indicator usage, the
  validity period, the domain (exact, wildcard or organisational), and that
  the logo embedded in the certificate (gzipped data URI in the logotype
  extension) is byte for byte the logo being published. Tested against two
  real public VMCs (eBay via DigiCert, CNN via Valimail) plus mutations
- GET /.well-known/bimi/vmc.pem (public, conditional, cacheable for an hour),
  and PUT/DELETE /api/v1/admin/bimi/certificate; the GET of the logo now
  reports the certificate as it stands against the logo being served, and
  replacing a logo under a held certificate says it no longer matches
- GET /api/v1/admin/bimi/check looks at what a receiver would: the logo, DMARC
  enforcement, the BIMI record, the public logo URL, the certificate and its
  public URL. Its HTTP client is HTTPS only and refuses non-public addresses
  after DNS, since the URLs come from DNS and an operator field
- the DNS record points a= at the held certificate when there is one

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/webmail/next.config.ts

@@ -36,6 +36,12 @@ const nextConfig: NextConfig = {
         source: "/.well-known/bimi/default.svg",
         destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/default.svg`,
       },
+      {
+        // The BIMI certificate (VMC/CMC) the DNS record's a= tag points at,
+        // fetched the same way as the logo above.
+        source: "/.well-known/bimi/vmc.pem",
+        destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/vmc.pem`,
+      },
       {
         source: "/.well-known/security.txt",
         destination: `${PROTOCOLS_SERVICE_URL}/.well-known/security.txt`,

services/webmail/src/wellknown-routing.test.ts

@@ -58,4 +58,12 @@ describe("the routes the protocols service owns", () => {
     expect(config).toContain("/.well-known/bimi/default.svg");
     expect(config).toMatch(/bimi\/default\.svg[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
   });
+
+  // The a= tag of the BIMI record points here when the certificate is held by
+  // the service; without the rewrite the Next 404 page is served instead, and
+  // the receiver sees a record whose certificate cannot be fetched.
+  it("routes the BIMI certificate to the service that stores it", () => {
+    expect(config).toContain("/.well-known/bimi/vmc.pem");
+    expect(config).toMatch(/bimi\/vmc\.pem[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
+  });
 });