fix(bimi): each domain's logo under its own URL, and the publisher actually wired

Two bugs found by the setup check right after the last deploy:

- every domain's BIMI record named the deployment's own mail host, and the
  server picked the domain from the host name, so only the primary domain's
  logo could be fetched: ciberlab.seg.br's record pointed at a 404. The logo
  and the certificate are now served at /.well-known/bimi/<domain>/..., the
  record names that, and the webmail routes it. The old path still answers
- SetBimiPublisher ran before SetBimiAPI, found no BIMI API to attach to and
  was dropped, so saving a logo never published the DNS record by itself. It is
  kept on the router now, so the order does not matter

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/webmail/next.config.ts

@@ -36,6 +36,16 @@ const nextConfig: NextConfig = {
         source: "/.well-known/bimi/default.svg",
         destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/default.svg`,
       },
+      {
+        // A record names its own domain in the path, so every domain the server
+        // hosts can publish its own logo and certificate from this one host.
+        source: "/.well-known/bimi/:domain/default.svg",
+        destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/:domain/default.svg`,
+      },
+      {
+        source: "/.well-known/bimi/:domain/vmc.pem",
+        destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/:domain/vmc.pem`,
+      },
       {
         // The BIMI certificate (VMC/CMC) the DNS record's a= tag points at,
         // fetched the same way as the logo above.

services/webmail/src/wellknown-routing.test.ts

@@ -66,4 +66,12 @@ describe("the routes the protocols service owns", () => {
     expect(config).toContain("/.well-known/bimi/vmc.pem");
     expect(config).toMatch(/bimi\/vmc\.pem[\s\S]{0,200}PROTOCOLS_SERVICE_URL/);
   });
+
+  // Each domain's record names its own logo and certificate under its own name.
+  // Without these rewrites only the host's primary domain had a logo that could
+  // be fetched; every other domain's record pointed at a 404.
+  it("routes the per-domain BIMI logo and certificate to the service", () => {
+    expect(config).toMatch(/bimi\/:domain\/default\.svg[\s\S]{0,200}PROTOCOLS_SERVICE_URL[^\n]*:domain\/default\.svg/);
+    expect(config).toMatch(/bimi\/:domain\/vmc\.pem[\s\S]{0,200}PROTOCOLS_SERVICE_URL[^\n]*:domain\/vmc\.pem/);
+  });
 });