feat(bimi): reconcile the BIMI record to Cloudflare and keep it in step with the logo

The reconciler never wrote the BIMI record: only the console's verification
knew about it, so a stored logo was never published to the zone.

- SyncDnsRecordsInput carries the BIMI logo and certificate URLs; the record is
  created, updated (a= added or dropped) and, when the logo is removed,
  deleted. Only a record carrying this reconciler's comment is retired: one
  made by hand is left alone
- bimi.Publish decides the record in one place for the timer sweep, the
  console's button and the panel's verification. A held certificate is
  advertised only while it is valid for the logo being served: replacing the
  logo ends the certificate, and a record that kept naming it makes every
  receiver reject BIMI, including those that need no certificate
- saving or removing the logo or the certificate triggers the reconciliation in
  the background; the panel shows the record as the server writes it, says when
  a certificate is held back and why, and has a publish-now button
- a read error is not 'no logo': the sync leaves the record alone instead of
  deleting it over a database hiccup

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_dns_api.go

@@ -29,10 +29,12 @@ type DnsSpecSource interface {
 // name already holding somebody else's value is not this server's to
 // overwrite - it may be the zone's mail, or a service nobody remembered.
 type ReconcileResult struct {
-	Domain    string   `json:"domain"`
-	Created   int      `json:"created"`
-	Updated   int      `json:"updated"`
-	Unchanged int      `json:"unchanged"`
+	Domain    string `json:"domain"`
+	Created   int    `json:"created"`
+	Updated   int    `json:"updated"`
+	Unchanged int    `json:"unchanged"`
+	// Deleted counts records retired because they are no longer wanted.
+	Deleted   int      `json:"deleted"`
 	Conflicts []string `json:"conflicts"`
 	Errors    []string `json:"errors"`
 }