feat(tls): o painel diz o digest que o registo TLSA tem de carregar

Uma associacao DANE e o SHA-256 sobre o SubjectPublicKeyInfo do certificado
que esta a ser servido. Se o que esta no DNS e o que o servidor apresenta se
afastarem, qualquer remetente que valide DANE recusa o correio -- e nada no
painel dizia porque.

Passa a mostrar o numero, para poder ser comparado com o registo publicado.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_tls_api.go

@@ -23,6 +23,12 @@ type TlsCertificateInspector interface {
 	CertificateSummary(host string) (issuer string, selfSigned bool, ok bool)
 }
 
+// TlsDaneInspector reports the digest a TLSA "3 1 1" record must carry for the
+// certificate currently being served.
+type TlsDaneInspector interface {
+	CertificateSpkiDigest(host string) (string, bool)
+}
+
 type adminTlsAPI struct {
 	source     TlsStatusSource
 	mailHost   string
@@ -99,6 +105,15 @@ func (a *adminTlsAPI) handleStatus(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// The number a DANE association has to match. Published so an operator can
+	// compare it against the TLSA record in DNS: if the two drift apart, every
+	// validating sender refuses the mail and nothing else here would say why.
+	if dane, ok := a.source.(TlsDaneInspector); ok {
+		if digest, found := dane.CertificateSpkiDigest(a.mailHost); found {
+			status["tlsa_digest"] = digest
+		}
+	}
+
 	if !status["has_certificate"].(bool) {
 		status["state"] = "NO_CERTIFICATE"
 	}