fix(bimi): each domain's logo under its own URL, and the publisher actually wired

Two bugs found by the setup check right after the last deploy:

- every domain's BIMI record named the deployment's own mail host, and the
  server picked the domain from the host name, so only the primary domain's
  logo could be fetched: ciberlab.seg.br's record pointed at a 404. The logo
  and the certificate are now served at /.well-known/bimi/<domain>/..., the
  record names that, and the webmail routes it. The old path still answers
- SetBimiPublisher ran before SetBimiAPI, found no BIMI API to attach to and
  was dropped, so saving a logo never published the DNS record by itself. It is
  kept on the router now, so the order does not matter

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/webmail/next.config.ts

@@ -36,6 +36,16 @@ const nextConfig: NextConfig = {
         source: "/.well-known/bimi/default.svg",
         destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/default.svg`,
       },
+      {
+        // A record names its own domain in the path, so every domain the server
+        // hosts can publish its own logo and certificate from this one host.
+        source: "/.well-known/bimi/:domain/default.svg",
+        destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/:domain/default.svg`,
+      },
+      {
+        source: "/.well-known/bimi/:domain/vmc.pem",
+        destination: `${PROTOCOLS_SERVICE_URL}/.well-known/bimi/:domain/vmc.pem`,
+      },
       {
         // The BIMI certificate (VMC/CMC) the DNS record's a= tag points at,
         // fetched the same way as the logo above.