feat(bimi): logo studio, certificate upload and a setup check in the console

The console took pasted SVG text and a URL. It now:

- takes a PNG or SVG and makes the logo BIMI accepts (SVG Tiny PS, square,
  at most 32 KB). An SVG has what the format forbids removed and is told what;
  a PNG is traced into vectors in the browser (imagetracerjs, public domain),
  walking down quality presets until it fits. The person positions it as in the
  photo editor: drag, zoom, background colour, preview in a circle or rounded
  square, and downloads the exact SVG to give a certificate authority
- holds the .pem the authority returns, validated against the logo and domain,
  and serves it at /.well-known/bimi/vmc.pem (routed by the webmail)
- shows the DNS record and runs the setup check (logo, DMARC, record, public
  URLs, certificate)
- a golden-file contract: the SVGs the studio produces are validated by the
  server's own validator (Go) and pinned by the studio's tests (TS)
- found by those tests: an element inside a link kept its onclick when the
  link was unwrapped; links are now unwrapped before cleaning
- the BIMI and photo texts are in Brazilian Portuguese with accents (they had
  been written without), and in Spanish with accents

A VMC cannot be generated from an image: it is issued by a certificate
authority. The README and the panel say so.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/internal/domain/bimi/svg_test.go

@@ -2,6 +2,8 @@ package bimi
 
 import (
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -150,3 +152,26 @@ func TestValidate_ReportsEveryViolationAtOnce(t *testing.T) {
 		}
 	}
 }
+
+// The webmail's logo studio (services/webmail/src/lib/bimiLogo.ts) produces the
+// files in testdata/studio, and its tests keep them current. This is the other
+// half of the contract: every one of them has to pass the validator that guards
+// the upload. A studio that starts producing something the server refuses
+// fails here, instead of in front of an operator who did everything right.
+func TestWhatTheStudioProducesIsAccepted(t *testing.T) {
+	files, err := filepath.Glob("testdata/studio/*.svg")
+	if err != nil || len(files) == 0 {
+		t.Fatalf("no studio output to check (%v)", err)
+	}
+	for _, file := range files {
+		t.Run(filepath.Base(file), func(t *testing.T) {
+			svg, err := os.ReadFile(file)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if violations := Validate(svg); len(violations) != 0 {
+				t.Errorf("the validator refused what the studio made: %v", violations)
+			}
+		})
+	}
+}