fix(dns): o botao de reconciliar nao criava registo nenhum

O painel listava os registos em falta e oferecia um botao para os criar, mas
esse botao chegava a um endpoint que so escrevia uma linha de auditoria e
respondia "REQUESTED". Nunca tocou no DNS. Quem tinha o token da Cloudflare
era o servico de protocolos, e a unica coisa capaz de o usar corria num
temporizador -- para um dominio so, o de MAIL_DOMAIN.

Por isso um dominio adicionado pela consola, como o cienciaembarcada.com.br,
nunca era reconciliado: os registos nao apareciam e o unico sintoma visivel
era a consola dizer que faltavam, para sempre.

- POST /api/v1/admin/dns/reconcile publica os registos de um dominio, agora,
  e devolve o que foi criado, corrigido e o que ficou em conflito
- o temporizador passa a percorrer todos os dominios ativos
- conflitos sao reportados, nao resolvidos: um registo do mesmo tipo e nome
  com outro valor pode ser correio da zona ou um servico de que ninguem se
  lembra, e nao e deste servidor decidir sobrepo-lo
- o erro do fornecedor fica no log, nao na resposta: pode nomear a conta ou
  a zona

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_dns_reconcile_test.go

@@ -0,0 +1,146 @@
+package httppresentation
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// Making the reconcile button do what its name says.
+//
+// It answered {"status":"REQUESTED","message":"DNS records are not verified by
+// this endpoint yet"} - it wrote an audit row and nothing else. The service
+// that can actually create a record, with the provider token in hand, exposed
+// no route at all, so the console could report a record missing and had no way
+// to fix it.
+
+type stubReconciler struct {
+	called  []string
+	created int
+	err     error
+}
+
+func (s *stubReconciler) ReconcileDomain(_ context.Context, domain string) (ReconcileResult, error) {
+	s.called = append(s.called, domain)
+	if s.err != nil {
+		return ReconcileResult{}, s.err
+	}
+	return ReconcileResult{Created: s.created, Domain: domain}, nil
+}
+
+func newReconcileAPI(t *testing.T, r *stubReconciler) *adminDnsAPI {
+	t.Helper()
+	return &adminDnsAPI{sessions: testVerifier(interopSecret), reconciler: r}
+}
+
+func adminRequest(target string) *http.Request {
+	req := httptest.NewRequest(http.MethodPost, target, strings.NewReader("{}"))
+	req.Header.Set("Authorization", "Bearer "+adminSurfaceToken2())
+	return req
+}
+
+func TestReconcileActuallyReconcilesTheDomain(t *testing.T) {
+	stub := &stubReconciler{created: 11}
+	rec := httptest.NewRecorder()
+	newReconcileAPI(t, stub).handleReconcile(rec, adminRequest("/api/v1/admin/dns/reconcile?domain=example.test"))
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("answered %d: %s", rec.Code, rec.Body)
+	}
+	if len(stub.called) != 1 || stub.called[0] != "example.test" {
+		t.Errorf("reconciled %v, want [example.test]", stub.called)
+	}
+
+	var body map[string]any
+	_ = json.NewDecoder(rec.Body).Decode(&body)
+	// It reports what it did. The old endpoint reported a status it had not
+	// established, which is how the console came to claim records were
+	// verified when nothing had looked at them.
+	if body["created"] != float64(11) {
+		t.Errorf("reported %v created", body["created"])
+	}
+}
+
+func TestReconcileRefusesWithoutAnAdminSession(t *testing.T) {
+	stub := &stubReconciler{}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/dns/reconcile?domain=example.test", nil)
+	newReconcileAPI(t, stub).handleReconcile(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("answered %d without a session", rec.Code)
+	}
+	if len(stub.called) != 0 {
+		t.Error("it wrote to DNS without an authenticated caller")
+	}
+}
+
+// A user session must not reach it: creating DNS records is an admin action.
+func TestReconcileRefusesAUserSession(t *testing.T) {
+	stub := &stubReconciler{}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/dns/reconcile?domain=example.test", nil)
+	req.Header.Set("Authorization", "Bearer "+interopSession)
+	newReconcileAPI(t, stub).handleReconcile(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("a webmail session reached the reconciler: %d", rec.Code)
+	}
+	if len(stub.called) != 0 {
+		t.Error("a webmail session wrote to DNS")
+	}
+}
+
+func TestReconcileRequiresADomain(t *testing.T) {
+	stub := &stubReconciler{}
+	rec := httptest.NewRecorder()
+	newReconcileAPI(t, stub).handleReconcile(rec, adminRequest("/api/v1/admin/dns/reconcile"))
+
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("answered %d with no domain", rec.Code)
+	}
+	if len(stub.called) != 0 {
+		t.Error("it reconciled something with no domain named")
+	}
+}
+
+// A provider that refuses has to be reported as a failure, not swallowed into
+// a cheerful answer the way the old endpoint did.
+func TestReconcileReportsAProviderFailure(t *testing.T) {
+	stub := &stubReconciler{err: errors.New("cloudflare refused the token")}
+	rec := httptest.NewRecorder()
+	newReconcileAPI(t, stub).handleReconcile(rec, adminRequest("/api/v1/admin/dns/reconcile?domain=example.test"))
+
+	if rec.Code < 500 {
+		t.Errorf("a provider failure answered %d, want a 5xx", rec.Code)
+	}
+	// The provider's own words must not travel to the browser: they can carry
+	// account identifiers.
+	if strings.Contains(rec.Body.String(), "cloudflare refused the token") {
+		t.Errorf("the provider error leaked: %s", rec.Body)
+	}
+}
+
+// Without the reconciler wired, the route says so rather than pretending.
+func TestReconcileSaysWhenItIsNotConfigured(t *testing.T) {
+	rec := httptest.NewRecorder()
+	api := &adminDnsAPI{sessions: testVerifier(interopSecret)}
+	api.handleReconcile(rec, adminRequest("/api/v1/admin/dns/reconcile?domain=example.test"))
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Errorf("answered %d with no reconciler configured", rec.Code)
+	}
+}
+
+func adminSurfaceToken2() string {
+	return mintSessionRaw(WebSession{
+		Subject: "mb-1", Email: "admin@example.test", Role: "SUPER_ADMIN",
+		Surface: "admin", Audience: "lambdamail:admin",
+		Purpose: "session", MfaSatisfied: true,
+		IssuedAt: interopIssuedAt, ExpiresAt: interopIssuedAt + 3600,
+	})
+}