feat(tls): o painel diz o digest que o registo TLSA tem de carregar

Uma associacao DANE e o SHA-256 sobre o SubjectPublicKeyInfo do certificado
que esta a ser servido. Se o que esta no DNS e o que o servidor apresenta se
afastarem, qualquer remetente que valide DANE recusa o correio -- e nada no
painel dizia porque.

Passa a mostrar o numero, para poder ser comparado com o registo publicado.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/webmail/messages/en.json

@@ -112,7 +112,8 @@
     "passwordReset": "Password changed. This user's sessions were signed out.",
     "passwordResetWarning": "Signs out every session this user holds, including one open right now.",
     "removeTotp": "Remove second factor",
-    "totpRemoved": "Second factor removed, with its recovery codes."
+    "totpRemoved": "Second factor removed, with its recovery codes.",
+    "tlsaDigest": "Digest for the TLSA record (DANE 3 1 1)"
   },
   "auth": {
     "adminLoginTitle": "Admin console",