fix(bimi): each domain's logo under its own URL, and the publisher actually wired

Two bugs found by the setup check right after the last deploy:

- every domain's BIMI record named the deployment's own mail host, and the
  server picked the domain from the host name, so only the primary domain's
  logo could be fetched: ciberlab.seg.br's record pointed at a 404. The logo
  and the certificate are now served at /.well-known/bimi/<domain>/..., the
  record names that, and the webmail routes it. The old path still answers
- SetBimiPublisher ran before SetBimiAPI, found no BIMI API to attach to and
  was dropped, so saving a logo never published the DNS record by itself. It is
  kept on the router now, so the order does not matter

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/router.go

@@ -41,6 +41,7 @@ type Router struct {
 	dnsReconciler DomainReconciler
 	dnsStatus     DnsStatusWriter
 	bimi          *bimiAPI
+	bimiPublish   func(domain string)
 	// degradedFunc reports a condition that leaves the service running but
 	// not fit for production, the clearest case being a self-signed
 	// certificate standing in for one Traefik never issued
@@ -81,6 +82,7 @@ func (r *Router) registerRoutes() {
 	r.mux.HandleFunc("/.well-known/security.txt", r.handleSecurityTxt)
 	r.mux.HandleFunc("/.well-known/bimi/default.svg", r.handleBimiLogo)
 	r.mux.HandleFunc("/.well-known/bimi/vmc.pem", r.handleBimiCertificate)
+	r.mux.HandleFunc("/.well-known/bimi/", r.handleBimiPerDomain)
 	r.mux.HandleFunc("/api/v1/admin/bimi", r.handleBimiAdmin)
 	r.mux.HandleFunc("/api/v1/admin/bimi/certificate", r.handleBimiCertificateAdmin)
 	r.mux.HandleFunc("/api/v1/admin/bimi/check", r.handleBimiCheck)