fix(bimi): each domain's logo under its own URL, and the publisher actually wired

Two bugs found by the setup check right after the last deploy:

- every domain's BIMI record named the deployment's own mail host, and the
  server picked the domain from the host name, so only the primary domain's
  logo could be fetched: ciberlab.seg.br's record pointed at a 404. The logo
  and the certificate are now served at /.well-known/bimi/<domain>/..., the
  record names that, and the webmail routes it. The old path still answers
- SetBimiPublisher ran before SetBimiAPI, found no BIMI API to attach to and
  was dropped, so saving a logo never published the DNS record by itself. It is
  kept on the router now, so the order does not matter

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/bimi_publication.go

@@ -22,15 +22,15 @@ func bimiPublication(ctx context.Context, repo *postgres.BimiRepository, cfg con
 		// Unknown is not "no logo": returning an empty publication here would
 		// have the sync delete the record over a database hiccup.
 		log.Printf("BIMI: could not read the logo for %s, leaving its record alone: %v", domain, err)
-		return bimi.Publication{LogoURL: httppresentation.BimiLogoURL(cfg.PrimaryMailHost)}
+		return bimi.Publication{LogoURL: httppresentation.BimiLogoURL(cfg.PrimaryMailHost, domain)}
 	}
 	if logo == nil {
 		return bimi.Publication{}
 	}
 	return bimi.Publish(
 		logo.SVG, logo.VmcPEM, logo.VmcURL, domain,
-		httppresentation.BimiLogoURL(cfg.PrimaryMailHost),
-		httppresentation.BimiVmcURL(cfg.PrimaryMailHost),
+		httppresentation.BimiLogoURL(cfg.PrimaryMailHost, domain),
+		httppresentation.BimiVmcURL(cfg.PrimaryMailHost, domain),
 		time.Now(),
 	)
 }