revert: foto de perfil e BIMI, para restaurar o servico

O site ficou a responder 502 em todos os hostnames depois do deploy destas
duas funcionalidades. A reversao vem primeiro; o diagnostico vem a seguir, com
o servico de pe.

As migracoes 0012 e 0013 ficam. Sao aditivas, nada no codigo revertido as usa,
e apaga-las deixaria a base de dados numa versao sem ficheiro correspondente,
o que parte o proprio migrate no arranque seguinte.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/domain/entity/dns_record.go

@@ -35,15 +35,6 @@ type DnsRecordSpec struct {
 	// this domain. Without it every message the relay forwards fails SPF
 	// (PLAN.md section 10.4).
 	RelaySpfInclude string
-	// BimiLogoURL is where the published mark is served from. Empty when the
-	// domain has no logo, and then no BIMI record is published at all: an
-	// advertised record pointing at nothing is worse than none, because a
-	// receiver stops looking once it finds one.
-	BimiLogoURL string
-	// BimiVmcURL is the Verified Mark Certificate. Gmail and Outlook render
-	// the logo only when the record carries one; without it the record is
-	// still valid and other clients may use it.
-	BimiVmcURL string
 }
 
 // BuildDnsRecordSpecs generates the DNS records of PLAN.md section 7: the 13
@@ -205,21 +196,6 @@ func BuildDnsRecordSpecs(spec DnsRecordSpec) []DnsRecord {
 		})
 	}
 
-	// BIMI, published only when there is a logo to point at.
-	if spec.BimiLogoURL != "" {
-		value := fmt.Sprintf("v=BIMI1; l=%s;", spec.BimiLogoURL)
-		if spec.BimiVmcURL != "" {
-			value = fmt.Sprintf("v=BIMI1; l=%s; a=%s;", spec.BimiLogoURL, spec.BimiVmcURL)
-		}
-		records = append(records, DnsRecord{
-			Type:    "TXT",
-			Name:    fmt.Sprintf("default._bimi.%s", domainName),
-			Value:   value,
-			TTL:     1,
-			Comment: "LambdaMail BIMI Record",
-		})
-	}
-
 	// 2. Conditional AAAA record if IPv6 is supplied
 	if ownsMailHost && serverIPv6 != "" {
 		records = append(records, DnsRecord{

services/protocols/internal/domain/entity/dns_record_test.go

@@ -195,72 +195,3 @@ func TestBuildDnsRecordSpecs_KeepsMailHostAddressesInsideTheDomain(t *testing.T)
 		t.Errorf("lost the mail host addresses (A=%v AAAA=%v)", a, aaaa)
 	}
 }
-
-// BIMI is published only when there is a mark to point at.
-//
-// A record that advertises a logo which is not there is worse than no record:
-// a receiver stops looking once it finds one, so an empty pointer buys a
-// failed fetch instead of the fallback it would otherwise have used.
-func TestBuildDnsRecordSpecs_BimiOnlyWhenThereIsALogo(t *testing.T) {
-	without := BuildDnsRecordSpecs(DnsRecordSpec{
-		DomainName: "example.test",
-		MailHost:   "mail.example.test",
-		ServerIPv4: "192.0.2.1",
-	})
-	for _, r := range without {
-		if strings.Contains(r.Name, "_bimi") {
-			t.Errorf("published %s with no logo configured", r.Name)
-		}
-	}
-
-	with := BuildDnsRecordSpecs(DnsRecordSpec{
-		DomainName:  "example.test",
-		MailHost:    "mail.example.test",
-		ServerIPv4:  "192.0.2.1",
-		BimiLogoURL: "https://mail.example.test/.well-known/bimi/default.svg",
-	})
-
-	var found *DnsRecord
-	for i, r := range with {
-		if r.Name == "default._bimi.example.test" {
-			found = &with[i]
-		}
-	}
-	if found == nil {
-		t.Fatal("no BIMI record was published for a domain with a logo")
-	}
-	if found.Type != "TXT" {
-		t.Errorf("BIMI record type is %q, want TXT", found.Type)
-	}
-	if !strings.HasPrefix(found.Value, "v=BIMI1;") {
-		t.Errorf("value %q does not start with the version tag", found.Value)
-	}
-	// No certificate configured, so no a= tag: an empty one would advertise a
-	// certificate that cannot be fetched.
-	if strings.Contains(found.Value, "a=") {
-		t.Errorf("value %q carries an empty certificate tag", found.Value)
-	}
-}
-
-// Gmail and Outlook render the mark only when the record points at a Verified
-// Mark Certificate, so the tag has to be carried when there is one.
-func TestBuildDnsRecordSpecs_BimiCarriesTheCertificateWhenConfigured(t *testing.T) {
-	specs := BuildDnsRecordSpecs(DnsRecordSpec{
-		DomainName:  "example.test",
-		MailHost:    "mail.example.test",
-		ServerIPv4:  "192.0.2.1",
-		BimiLogoURL: "https://mail.example.test/.well-known/bimi/default.svg",
-		BimiVmcURL:  "https://mail.example.test/.well-known/bimi/default.pem",
-	})
-
-	for _, r := range specs {
-		if r.Name != "default._bimi.example.test" {
-			continue
-		}
-		if !strings.Contains(r.Value, "a=https://mail.example.test/.well-known/bimi/default.pem") {
-			t.Errorf("value %q does not carry the certificate", r.Value)
-		}
-		return
-	}
-	t.Fatal("no BIMI record was published")
-}