fix(dns): a lista dizia PENDING, nunca verificado, com tudo verificado

O crocha na lista de dominios lia-se da coluna dns_status, e nada lhe escrevia
depois do onboarding. A verificacao corre no servico de protocolos, que tem o
resolvedor, e a resposta ia directa para o browser sem ficar registada -- por
isso um dominio com 13 de 13 registos publicados e a resolver continuava
listado como PENDING, ultima verificacao "Nunca", ao lado da pagina que dizia
o contrario.

Quem verificou passa a escrever o que encontrou. Falhar a gravar nao
transforma uma verificacao boa num erro para o operador: fica no log.

A coluna aceita apenas PENDING, VERIFIED, PARTIAL, DRIFT e ERROR, e o
verificador tambem diz MISSING e UNKNOWN. Escrever qualquer uma dessas violava
a check constraint, a actualizacao era rejeitada e o crocha ficava velo na
mesma -- exactamente o sintoma que isto vem corrigir. Ha um teste so para essa
traducao.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_dns_api.go

@@ -47,6 +47,15 @@ type DomainReconciler interface {
 	ReconcileDomain(ctx context.Context, domain string) (ReconcileResult, error)
 }
 
+// DnsStatusWriter records the outcome of a verification.
+//
+// Verification lives here, with the resolver; the badge the console shows is
+// read from the domains table. Without this the two never met: a domain could
+// verify 13 of 13 and still be listed as PENDING, never checked.
+type DnsStatusWriter interface {
+	SaveDnsStatus(ctx context.Context, domain, status string) error
+}
+
 type adminDnsAPI struct {
 	spec     DnsSpecSource
 	verifier DnsRecordVerifier
@@ -54,6 +63,9 @@ type adminDnsAPI struct {
 	// reconciler is optional: without it the route reports that the feature
 	// is not configured rather than answering as though it had run.
 	reconciler DomainReconciler
+	// status is optional: without it verification still answers, it just is
+	// not written down.
+	status DnsStatusWriter
 }
 
 // handleReconcile publishes the records a domain is missing.
@@ -168,6 +180,15 @@ func (a *adminDnsAPI) handleVerify(w http.ResponseWriter, r *http.Request) {
 		status = "PARTIAL"
 	}
 
+	// Written down before answering, so the list badge and this page agree.
+	if a.status != nil {
+		if err := a.status.SaveDnsStatus(r.Context(), domain, status); err != nil {
+			// The check itself succeeded; failing to file it must not turn a
+			// good answer into an error for the operator.
+			log.Printf("dns: verified %s but could not record the status: %v", domain, err)
+		}
+	}
+
 	writeJSON(w, http.StatusOK, map[string]any{
 		"domain":   domain,
 		"status":   status,
@@ -189,6 +210,7 @@ func (r *Router) SetAdminDnsAPI(spec DnsSpecSource, verifier DnsRecordVerifier,
 		// either order. They could not before, and main.go called them in the
 		// order that lost the reconciler.
 		reconciler: r.dnsReconciler,
+		status:     r.dnsStatus,
 	}
 }
 
@@ -208,6 +230,14 @@ func (r *Router) handleAdminDnsReconcile(w http.ResponseWriter, req *http.Reques
 
 // SetDnsReconciler enables the reconcile route to actually publish records.
 // Without it the route reports that reconciliation is not configured.
+// SetDnsStatusWriter lets verification record what it found.
+func (r *Router) SetDnsStatusWriter(w DnsStatusWriter) {
+	r.dnsStatus = w
+	if r.dns != nil {
+		r.dns.status = w
+	}
+}
+
 func (r *Router) SetDnsReconciler(reconciler DomainReconciler) {
 	// Kept on the router as well as on the API. Assigning only to r.dns meant
 	// that calling this before SetAdminDnsAPI silently did nothing: the field

services/protocols/internal/presentation/http/admin_dns_reconcile_test.go

@@ -204,3 +204,44 @@ func TestReconcilerSurvivesBeingWiredBeforeTheDnsAPI(t *testing.T) {
 		})
 	}
 }
+
+type stubStatusWriter struct {
+	domain string
+	status string
+	calls  int
+}
+
+func (s *stubStatusWriter) SaveDnsStatus(_ context.Context, domain, status string) error {
+	s.calls++
+	s.domain, s.status = domain, status
+	return nil
+}
+
+// The console listed a fully verified domain as PENDING, "last checked: never".
+//
+// Verification ran in the protocols service, which owns the resolver, and its
+// answer went straight to the browser. Nothing wrote it down, and the badge in
+// the list is read from the domains table - so it stayed at the value set when
+// the domain was first added, no matter how many times it verified 13 of 13.
+func TestVerifyRecordsWhatItFound(t *testing.T) {
+	writer := &stubStatusWriter{}
+	api := &adminDnsAPI{
+		spec: stubSpec{}, verifier: stubVerifier{},
+		sessions: testVerifier(interopSecret), status: writer,
+	}
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/dns/verify?domain=example.test", nil)
+	req.Header.Set("Authorization", "Bearer "+adminSurfaceToken2())
+	api.handleVerify(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("answered %d: %s", rec.Code, rec.Body)
+	}
+	if writer.calls != 1 {
+		t.Fatalf("wrote the status %d times, want 1: the console keeps showing a stale badge", writer.calls)
+	}
+	if writer.domain != "example.test" {
+		t.Errorf("recorded status for %q, want example.test", writer.domain)
+	}
+}

services/protocols/internal/presentation/http/router.go

@@ -39,6 +39,7 @@ type Router struct {
 	dns *adminDnsAPI
 	// dnsReconciler is held here so it survives being set before dns exists.
 	dnsReconciler DomainReconciler
+	dnsStatus     DnsStatusWriter
 	// degradedFunc reports a condition that leaves the service running but
 	// not fit for production, the clearest case being a self-signed
 	// certificate standing in for one Traefik never issued