fix(dns): o botao de reconciliar nao criava registo nenhum

O painel listava os registos em falta e oferecia um botao para os criar, mas
esse botao chegava a um endpoint que so escrevia uma linha de auditoria e
respondia "REQUESTED". Nunca tocou no DNS. Quem tinha o token da Cloudflare
era o servico de protocolos, e a unica coisa capaz de o usar corria num
temporizador -- para um dominio so, o de MAIL_DOMAIN.

Por isso um dominio adicionado pela consola, como o cienciaembarcada.com.br,
nunca era reconciliado: os registos nao apareciam e o unico sintoma visivel
era a consola dizer que faltavam, para sempre.

- POST /api/v1/admin/dns/reconcile publica os registos de um dominio, agora,
  e devolve o que foi criado, corrigido e o que ficou em conflito
- o temporizador passa a percorrer todos os dominios ativos
- conflitos sao reportados, nao resolvidos: um registo do mesmo tipo e nome
  com outro valor pode ser correio da zona ou um servico de que ninguem se
  lembra, e nao e deste servidor decidir sobrepo-lo
- o erro do fornecedor fica no log, nao na resposta: pode nomear a conta ou
  a zona

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_dns_api.go

@@ -2,6 +2,7 @@ package httppresentation
 
 import (
 	"context"
+	"log"
 	"net/http"
 	"strings"
 
@@ -22,10 +23,79 @@ type DnsSpecSource interface {
 	ExpectedRecords(ctx context.Context, domain string) ([]entity.DnsRecord, error)
 }
 
+// ReconcileResult is what one reconciliation did.
+//
+// Conflicts are reported rather than resolved: a record of the right type and
+// name already holding somebody else's value is not this server's to
+// overwrite - it may be the zone's mail, or a service nobody remembered.
+type ReconcileResult struct {
+	Domain    string   `json:"domain"`
+	Created   int      `json:"created"`
+	Updated   int      `json:"updated"`
+	Unchanged int      `json:"unchanged"`
+	Conflicts []string `json:"conflicts"`
+	Errors    []string `json:"errors"`
+}
+
+// DomainReconciler publishes a domain's expected records through the DNS
+// provider, creating what is missing and correcting what disagrees.
+//
+// This is the half the console never had. Verification could say a record was
+// missing; nothing exposed the ability to then create it, even though the
+// service holding the provider token could do exactly that.
+type DomainReconciler interface {
+	ReconcileDomain(ctx context.Context, domain string) (ReconcileResult, error)
+}
+
 type adminDnsAPI struct {
 	spec     DnsSpecSource
 	verifier DnsRecordVerifier
 	sessions *WebSessionVerifier
+	// reconciler is optional: without it the route reports that the feature
+	// is not configured rather than answering as though it had run.
+	reconciler DomainReconciler
+}
+
+// handleReconcile publishes the records a domain is missing.
+//
+// The console's reconcile button used to reach an endpoint that wrote an audit
+// row and answered "REQUESTED" - it never touched DNS, and the operator was
+// left with a list of missing records and no way to act on it.
+func (a *adminDnsAPI) handleReconcile(w http.ResponseWriter, r *http.Request) {
+	token := bearerOrCookie(r, "lm_admin_session")
+	if token == "" {
+		writeError(w, http.StatusUnauthorized, "UNAUTHORIZED", "Admin session required")
+		return
+	}
+	if _, err := a.sessions.RequireSurface(token, "admin"); err != nil {
+		// Creating DNS records is an administrative action; a webmail session
+		// carries the wrong audience and stops here.
+		writeError(w, http.StatusUnauthorized, "UNAUTHORIZED", "Admin session required")
+		return
+	}
+
+	domain := strings.TrimSpace(r.URL.Query().Get("domain"))
+	if domain == "" {
+		writeError(w, http.StatusBadRequest, "DOMAIN_REQUIRED", "A domain is required")
+		return
+	}
+	if a.reconciler == nil {
+		writeError(w, http.StatusServiceUnavailable, "RECONCILER_UNAVAILABLE",
+			"DNS reconciliation needs a provider token to be configured")
+		return
+	}
+
+	result, err := a.reconciler.ReconcileDomain(r.Context(), domain)
+	if err != nil {
+		// Logged rather than echoed: a provider error can name the account or
+		// the zone, and that is not the browser's business.
+		log.Printf("dns: could not reconcile %s: %v", domain, err)
+		writeError(w, http.StatusBadGateway, "RECONCILE_FAILED",
+			"The DNS provider refused the request. Check the API token and the zone.")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, result)
 }
 
 // handleVerify checks every expected record against public resolvers and
@@ -116,6 +186,28 @@ func (r *Router) SetAdminDnsAPI(spec DnsSpecSource, verifier DnsRecordVerifier,
 	r.dns = &adminDnsAPI{spec: spec, verifier: verifier, sessions: NewWebSessionVerifier(sessionSecret)}
 }
 
+// handleAdminDnsReconcile publishes the records a domain is missing.
+func (r *Router) handleAdminDnsReconcile(w http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodPost {
+		writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "POST required")
+		return
+	}
+	if r.dns == nil {
+		writeError(w, http.StatusServiceUnavailable, "DNS_API_DISABLED",
+			"DNS reconciliation needs JWT_SECRET and a configured domain")
+		return
+	}
+	r.dns.handleReconcile(w, req)
+}
+
+// SetDnsReconciler enables the reconcile route to actually publish records.
+// Without it the route reports that reconciliation is not configured.
+func (r *Router) SetDnsReconciler(reconciler DomainReconciler) {
+	if r.dns != nil {
+		r.dns.reconciler = reconciler
+	}
+}
+
 func (r *Router) handleAdminDnsVerify(w http.ResponseWriter, req *http.Request) {
 	if r.dns == nil {
 		writeError(w, http.StatusServiceUnavailable, "DNS_API_DISABLED",