feat(bimi): reconcile the BIMI record to Cloudflare and keep it in step with the logo

The reconciler never wrote the BIMI record: only the console's verification
knew about it, so a stored logo was never published to the zone.

- SyncDnsRecordsInput carries the BIMI logo and certificate URLs; the record is
  created, updated (a= added or dropped) and, when the logo is removed,
  deleted. Only a record carrying this reconciler's comment is retired: one
  made by hand is left alone
- bimi.Publish decides the record in one place for the timer sweep, the
  console's button and the panel's verification. A held certificate is
  advertised only while it is valid for the logo being served: replacing the
  logo ends the certificate, and a record that kept naming it makes every
  receiver reject BIMI, including those that need no certificate
- saving or removing the logo or the certificate triggers the reconciliation in
  the background; the panel shows the record as the server writes it, says when
  a certificate is held back and why, and has a publish-now button
- a read error is not 'no logo': the sync leaves the record alone instead of
  deleting it over a database hiccup

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/internal/domain/bimi/publish_test.go

@@ -0,0 +1,65 @@
+package bimi
+
+import (
+	"testing"
+	"time"
+)
+
+const (
+	pubLogo = "https://mail.ebay.com/.well-known/bimi/default.svg"
+	pubCert = "https://mail.ebay.com/.well-known/bimi/vmc.pem"
+)
+
+func TestPublishNothingWithoutALogo(t *testing.T) {
+	if got := Publish(nil, nil, "https://x.test/v.pem", "ebay.com", pubLogo, pubCert, fixtureNow); got != (Publication{}) {
+		t.Fatalf("a domain with no logo must publish nothing, got %+v", got)
+	}
+}
+
+func TestPublishLogoOnly(t *testing.T) {
+	got := Publish(read(t, "ebay.svg"), nil, "", "ebay.com", pubLogo, pubCert, fixtureNow)
+	if got.LogoURL != pubLogo || got.CertificateURL != "" || got.Withheld != "" {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestPublishAnExternalCertificateURL(t *testing.T) {
+	got := Publish(read(t, "ebay.svg"), nil, " https://vmc.example.test/x.pem ", "ebay.com", pubLogo, pubCert, fixtureNow)
+	if got.CertificateURL != "https://vmc.example.test/x.pem" {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestPublishTheHeldCertificateWhileItIsValidForTheLogo(t *testing.T) {
+	got := Publish(read(t, "ebay.svg"), read(t, "ebay.pem"), "https://old.test/x.pem", "ebay.com", pubLogo, pubCert, fixtureNow)
+	// The held one wins over an external URL: it is the one checked against this logo
+	if got.CertificateURL != pubCert || got.Withheld != "" {
+		t.Fatalf("%+v", got)
+	}
+}
+
+// The reason this exists: replacing the logo under a held certificate must not
+// leave a record that points receivers at a certificate for another picture.
+func TestPublishWithholdsACertificateThatNoLongerMatchesTheLogo(t *testing.T) {
+	got := Publish(read(t, "cnn.svg"), read(t, "ebay.pem"), "", "ebay.com", pubLogo, pubCert, fixtureNow)
+	if got.LogoURL != pubLogo {
+		t.Errorf("the logo must still be published: %+v", got)
+	}
+	if got.CertificateURL != "" || got.Withheld != "logoMismatch" {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestPublishWithholdsAnExpiredCertificate(t *testing.T) {
+	got := Publish(read(t, "ebay.svg"), read(t, "ebay.pem"), "", "ebay.com", pubLogo, pubCert, time.Date(2028, 1, 1, 0, 0, 0, 0, time.UTC))
+	if got.CertificateURL != "" || got.Withheld != "validity" {
+		t.Fatalf("%+v", got)
+	}
+}
+
+func TestPublishFallsBackToTheExternalURLWhenTheHeldCertificateIsWithheld(t *testing.T) {
+	got := Publish(read(t, "cnn.svg"), read(t, "ebay.pem"), "https://vmc.example.test/x.pem", "ebay.com", pubLogo, pubCert, fixtureNow)
+	if got.CertificateURL != "https://vmc.example.test/x.pem" || got.Withheld == "" {
+		t.Fatalf("%+v", got)
+	}
+}