feat(tls): o painel diz o digest que o registo TLSA tem de carregar

Uma associacao DANE e o SHA-256 sobre o SubjectPublicKeyInfo do certificado
que esta a ser servido. Se o que esta no DNS e o que o servidor apresenta se
afastarem, qualquer remetente que valide DANE recusa o correio -- e nada no
painel dizia porque.

Passa a mostrar o numero, para poder ser comparado com o registo publicado.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/infrastructure/tls/provider_status.go

@@ -2,8 +2,10 @@ package tlsprovider
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/hex"
 	"time"
 
 	"lambdamail/protocols/internal/application/port"
@@ -94,3 +96,18 @@ func (s *ProviderStatus) CertificateSummary(host string) (string, bool, bool) {
 		leaf.CheckSignature(leaf.SignatureAlgorithm, leaf.RawTBSCertificate, leaf.Signature) == nil
 	return issuer, selfSigned, true
 }
+
+// CertificateSpkiDigest is the SHA-256 over the certificate's
+// SubjectPublicKeyInfo: the number a TLSA "3 1 1" record has to carry.
+//
+// Published so an operator can compare what is in DNS against what the server
+// is actually serving. When those two disagree, every DANE-validating sender
+// refuses the mail, and nothing else on the panel would show why.
+func (s *ProviderStatus) CertificateSpkiDigest(host string) (string, bool) {
+	leaf := s.leafFor(host)
+	if leaf == nil {
+		return "", false
+	}
+	sum := sha256.Sum256(leaf.RawSubjectPublicKeyInfo)
+	return hex.EncodeToString(sum[:]), true
+}