Revert "revert: foto de perfil e BIMI, para restaurar o servico"

Repoe as duas funcionalidades. A reversao foi uma precaucao enquanto o site
estava em baixo, e acabou por ser ela a provar que a culpa nao era delas: o
502 continuou depois de reverter.

A avaria era o servico web nao declarar porta nenhuma, o que levava o Coolify
a gerar um servico Traefik apontado ao porto 80. Fica corrigida no commit
anterior, com expose 3000.

As migracoes 0012 e 0013 nunca sairam do repositorio nem da base de dados, por
isso o codigo reposto encontra as tabelas que espera.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/main.go

@@ -230,11 +230,15 @@ func run(cfg config) {
 		// list stops disagreeing with the page next to it.
 		router.SetDnsStatusWriter(postgres.NewDomainRepository(pool))
 		router.SetAdminDnsAPI(
-			&dnsSpecSource{cfg: cfg, dkim: dkimRepo},
+			&dnsSpecSource{cfg: cfg, dkim: dkimRepo, bimi: postgres.NewBimiRepository(pool)},
 			netdns.NewPublicVerifier(),
 			cfg.JwtSecret,
 		)
 	}
+	// The BIMI mark: served to receivers over the well-known URL, managed from
+	// the domains panel.
+	router.SetBimiAPI(bimiStore{postgres.NewBimiRepository(pool)}, cfg.JwtSecret, cfg.domain())
+
 	// The TLS panel reads the live watcher instead of the constants the admin
 	// service used to return, which reported a healthy certificate whatever
 	// the process actually held.
@@ -698,6 +702,7 @@ func runHealthcheck() {
 type dnsSpecSource struct {
 	cfg  config
 	dkim *postgres.DkimRepository
+	bimi *postgres.BimiRepository
 }
 
 func (s *dnsSpecSource) ExpectedRecords(ctx context.Context, domain string) ([]entity.DnsRecord, error) {
@@ -710,6 +715,15 @@ func (s *dnsSpecSource) ExpectedRecords(ctx context.Context, domain string) ([]e
 		RelaySpfInclude: relayConfig(s.cfg).SpfInclude(),
 	}
 
+	// The BIMI record is published only when a mark is actually stored, so
+	// the panel never advertises a logo that would 404.
+	if s.bimi != nil {
+		if logo, err := s.bimi.Load(ctx, domain); err == nil && logo != nil {
+			spec.BimiLogoURL = httppresentation.BimiLogoURL(s.cfg.PrimaryMailHost)
+			spec.BimiVmcURL = logo.VmcURL
+		}
+	}
+
 	// Read rather than provisioned: verifying must not create keys as a side
 	// effect of somebody opening a screen.
 	if s.dkim != nil {