feat(bimi): logo studio, certificate upload and a setup check in the console

The console took pasted SVG text and a URL. It now:

- takes a PNG or SVG and makes the logo BIMI accepts (SVG Tiny PS, square,
  at most 32 KB). An SVG has what the format forbids removed and is told what;
  a PNG is traced into vectors in the browser (imagetracerjs, public domain),
  walking down quality presets until it fits. The person positions it as in the
  photo editor: drag, zoom, background colour, preview in a circle or rounded
  square, and downloads the exact SVG to give a certificate authority
- holds the .pem the authority returns, validated against the logo and domain,
  and serves it at /.well-known/bimi/vmc.pem (routed by the webmail)
- shows the DNS record and runs the setup check (logo, DMARC, record, public
  URLs, certificate)
- a golden-file contract: the SVGs the studio produces are validated by the
  server's own validator (Go) and pinned by the studio's tests (TS)
- found by those tests: an element inside a link kept its onclick when the
  link was unwrapped; links are now unwrapped before cleaning
- the BIMI and photo texts are in Brazilian Portuguese with accents (they had
  been written without), and in Spanish with accents

A VMC cannot be generated from an image: it is issued by a certificate
authority. The README and the panel say so.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/webmail/messages/en.json

@@ -115,14 +115,79 @@
     "totpRemoved": "Second factor removed, with its recovery codes.",
     "tlsaDigest": "Digest for the TLSA record (DANE 3 1 1)",
     "bimiTitle": "BIMI for {domain}",
-    "bimiExplainer": "BIMI is the only mechanism that shows an image beside your mail in external clients. It is per domain, not per user. Gmail and Outlook render it only when the record points at a VMC.",
+    "bimiExplainer": "BIMI is the only mechanism that shows an image next to your mail in outside clients. It is per domain, not per user. Upload the logo as a PNG or SVG and the system converts it to the BIMI format. Gmail and Apple Mail show it only with a certificate (VMC or CMC) issued by a certificate authority, which this system cannot create.",
     "bimiConfigured": "Logo published",
     "bimiNotConfigured": "No logo",
     "bimiNoVmc": "No VMC: Gmail and Outlook will not show this logo.",
-    "bimiSvg": "Logo (SVG Tiny PS)",
     "bimiVmc": "VMC URL (optional)",
     "bimiRejected": "The logo does not meet SVG Tiny Portable/Secure:",
-    "bimiSaved": "Logo saved."
+    "bimiSaved": "Logo saved.",
+    "bimiNone": "No logo",
+    "bimiChoose": "Choose PNG or SVG",
+    "bimiReplace": "Replace logo",
+    "bimiFormatHint": "PNG or SVG. The result is a square SVG Tiny PS of at most 32 KB.",
+    "bimiDragHint": "Drag to position. Mail clients show the logo inside a circle or a rounded square.",
+    "bimiZoom": "Zoom",
+    "bimiBackground": "Background colour",
+    "bimiBrandTitle": "Brand name (SVG title)",
+    "bimiMask": "Preview",
+    "bimiMask_circle": "Circle",
+    "bimiMask_rounded": "Rounded square",
+    "bimiMask_none": "No mask",
+    "bimiPreset": "Conversion quality",
+    "bimiPreset_high": "High (most faithful)",
+    "bimiPreset_balanced": "Balanced",
+    "bimiPreset_compact": "Compact",
+    "bimiPreset_tiny": "Minimal",
+    "bimiTraced": "The PNG was converted to vector, which loses some detail. For the sharpest result, upload the original SVG.",
+    "bimiAutoLowered": "The quality was lowered automatically to fit in 32 KB.",
+    "bimiSize": "{size} of {max}",
+    "bimiTooBig": "The file is over 32 KB. Pick a lower quality or simplify the drawing.",
+    "bimiRemoved": "Removed from the file, because BIMI does not allow them: {items}.",
+    "bimiTextWarning": "The logo contains text, which uses the reader's font and may look different. Convert the text to outlines in your editor.",
+    "bimiDownload": "Download SVG",
+    "bimiSaveLogo": "Save logo",
+    "bimiCertTitle": "Certificate (VMC or CMC)",
+    "bimiCertExplainer": "Gmail and Apple Mail show the logo only with a certificate issued by a certificate authority such as DigiCert, Entrust or SSL.com: a VMC, for a registered trademark, or a CMC, for a mark in use. This system cannot create that certificate. Download the SVG above, send it to the authority, and put the .pem file it returns here. Gmail accepts both types; other clients may require a VMC.",
+    "bimiCertChoose": "Upload .pem file",
+    "bimiCertReplace": "Replace certificate",
+    "bimiCertPaste": "Or paste the .pem contents",
+    "bimiCertSave": "Save certificate",
+    "bimiCertValid": "Valid certificate",
+    "bimiCertInvalid": "Certificate has problems",
+    "bimiCertIssued": "Issued to {organization} by {issuer}",
+    "bimiCertValidUntil": "Valid until {date}",
+    "bimiCertDomains": "Domains: {names}",
+    "bimiCertMatches": "It carries exactly this logo.",
+    "bimiCertMismatch": "The logo inside the certificate is not the one published. Upload the SVG it was issued for.",
+    "bimiCertRemove": "Remove certificate",
+    "bimiCertSaved": "Certificate saved.",
+    "bimiCertRejected": "The certificate was refused:",
+    "bimiRecordTitle": "DNS record",
+    "bimiRecordHint": "This TXT record is created by the DNS reconciliation. Check it, or create it by hand at your provider.",
+    "bimiCopy": "Copy",
+    "bimiCopied": "Copied",
+    "bimiCheckTitle": "Check the setup",
+    "bimiCheckExplainer": "Looks at DNS and the public URLs the way a mail server would, and says which part is wrong.",
+    "bimiCheckRun": "Check now",
+    "bimiCheckRunning": "Checking...",
+    "bimiCheckReady": "Everything is in place for BIMI.",
+    "bimiCheckNotReady": "Some items need fixing.",
+    "bimiCheckStatus_ok": "OK",
+    "bimiCheckStatus_warn": "Notice",
+    "bimiCheckStatus_fail": "Failed",
+    "bimiCheckItem_logo": "Logo file",
+    "bimiCheckItem_dmarc": "DMARC policy",
+    "bimiCheckItem_record": "BIMI record in DNS",
+    "bimiCheckItem_logoUrl": "Public URL of the logo",
+    "bimiCheckItem_certificate": "Certificate",
+    "bimiCheckItem_certificateUrl": "Public URL of the certificate",
+    "bimiError_notXml": "That file is not a valid SVG.",
+    "bimiError_notSvg": "That file is not an SVG.",
+    "bimiError_noSize": "The SVG has no size (viewBox, or width and height), so it cannot be positioned.",
+    "bimiError_empty": "No drawing could be found in that file.",
+    "bimiError_notImage": "Choose a PNG or SVG file.",
+    "bimiError_tooComplex": "The drawing is too complex to fit in 32 KB."
   },
   "auth": {
     "adminLoginTitle": "Admin console",