feat(bimi): reconcile the BIMI record to Cloudflare and keep it in step with the logo

The reconciler never wrote the BIMI record: only the console's verification
knew about it, so a stored logo was never published to the zone.

- SyncDnsRecordsInput carries the BIMI logo and certificate URLs; the record is
  created, updated (a= added or dropped) and, when the logo is removed,
  deleted. Only a record carrying this reconciler's comment is retired: one
  made by hand is left alone
- bimi.Publish decides the record in one place for the timer sweep, the
  console's button and the panel's verification. A held certificate is
  advertised only while it is valid for the logo being served: replacing the
  logo ends the certificate, and a record that kept naming it makes every
  receiver reject BIMI, including those that need no certificate
- saving or removing the logo or the certificate triggers the reconciliation in
  the background; the panel shows the record as the server writes it, says when
  a certificate is held back and why, and has a publish-now button
- a read error is not 'no logo': the sync leaves the record alone instead of
  deleting it over a database hiccup

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/bimi_publication.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"lambdamail/protocols/internal/domain/bimi"
+	"lambdamail/protocols/internal/infrastructure/postgres"
+	httppresentation "lambdamail/protocols/internal/presentation/http"
+)
+
+// bimiPublication is what a domain's BIMI record should say, for the sync, the
+// background sweep and the console alike. Read each time, so a logo saved a
+// moment ago is what gets published and a removed one stops being published.
+func bimiPublication(ctx context.Context, repo *postgres.BimiRepository, cfg config, domain string) bimi.Publication {
+	if repo == nil {
+		return bimi.Publication{}
+	}
+	logo, err := repo.Load(ctx, domain)
+	if err != nil {
+		// Unknown is not "no logo": returning an empty publication here would
+		// have the sync delete the record over a database hiccup.
+		log.Printf("BIMI: could not read the logo for %s, leaving its record alone: %v", domain, err)
+		return bimi.Publication{LogoURL: httppresentation.BimiLogoURL(cfg.PrimaryMailHost)}
+	}
+	if logo == nil {
+		return bimi.Publication{}
+	}
+	return bimi.Publish(
+		logo.SVG, logo.VmcPEM, logo.VmcURL, domain,
+		httppresentation.BimiLogoURL(cfg.PrimaryMailHost),
+		httppresentation.BimiVmcURL(cfg.PrimaryMailHost),
+		time.Now(),
+	)
+}