#32: file composed mail, and verify DNS records for real

Three things the console and the mail client were getting wrong.

**Sent stayed empty and drafts would not save.** Both write through the same
persistence path, and both failed on the same constraint: spf_result,
dkim_result and dmarc_result are restricted to the RFC verdict vocabulary and
are nullable, so "not evaluated" has to be NULL. The compose path left them at
Go's zero value, which sends an empty string - satisfying neither the CHECK nor
the meaning - and the insert was rejected. Filing the Sent copy is deliberately
non-fatal, so it failed silently; saving a draft reported the error. Inbound
mail was unaffected because it always supplies a real verdict, which is also
why the existing test never caught it.

**DNS reconciliation could not verify anything.** The console posted to the
auth service, which has no resolver, so the endpoint recorded the request and
re-read the status already in the database. The machinery to do it properly
already existed - the background reconciler resolves every expected record
through public resolvers - it just was not reachable from the console.

Adds GET /api/v1/admin/dns/verify to the protocols service, which owns both the
resolver and the record spec, and wires the domains screen to it: every
expected record, its expected value, and whether it actually resolves. A
proxied record is reported as present rather than matching, because behind a
proxy the published answer is the provider's address and comparing values would
always disagree. Reconciliation still runs afterwards so the stored status and
the audit trail stay in step.

The spec is read, never provisioned: opening a screen must not create DKIM keys
as a side effect.

Verified: the persistence test fails without the fix with the exact constraint
violation (email_messages_dkim_result_check), 22 Go packages and 36 webmail
tests green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/internal/presentation/http/admin_dns_api.go

@@ -0,0 +1,126 @@
+package httppresentation
+
+import (
+	"context"
+	"net/http"
+	"strings"
+
+	"lambdamail/protocols/internal/domain/entity"
+)
+
+// DnsRecordVerifier answers whether one expected record is actually published.
+// Implemented by the same public-resolver verifier the reconciler uses, so the
+// console and the background sync agree on what "verified" means.
+type DnsRecordVerifier interface {
+	VerifyRecord(ctx context.Context, record entity.DnsRecord) (bool, string)
+}
+
+// DnsSpecSource builds the records a domain is expected to publish. It lives
+// behind an interface because assembling the spec needs the DKIM public keys,
+// which only the service holding the vault can read.
+type DnsSpecSource interface {
+	ExpectedRecords(ctx context.Context, domain string) ([]entity.DnsRecord, error)
+}
+
+type adminDnsAPI struct {
+	spec     DnsSpecSource
+	verifier DnsRecordVerifier
+	sessions *WebSessionVerifier
+}
+
+// handleVerify checks every expected record against public resolvers and
+// reports each one individually.
+//
+// This is the endpoint the admin console's reconcile button had no equivalent
+// of. The auth service answered it by writing an audit row and re-reading the
+// stored status, because it has no resolver - so the console could only ever
+// repeat what the database already believed. Verification belongs here, with
+// the resolver and the record spec.
+func (a *adminDnsAPI) handleVerify(w http.ResponseWriter, r *http.Request) {
+	token := bearerOrCookie(r, "lm_admin_session")
+	if token == "" {
+		writeError(w, http.StatusUnauthorized, "UNAUTHORIZED", "Admin session required")
+		return
+	}
+	if _, err := a.sessions.RequireSurface(token, "admin"); err != nil {
+		writeError(w, http.StatusUnauthorized, "UNAUTHORIZED", "Admin session required")
+		return
+	}
+
+	domain := strings.TrimSpace(r.URL.Query().Get("domain"))
+	if domain == "" {
+		writeError(w, http.StatusBadRequest, "DOMAIN_REQUIRED", "A domain is required")
+		return
+	}
+
+	expected, err := a.spec.ExpectedRecords(r.Context(), domain)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "SPEC_FAILED", "Could not assemble the expected records")
+		return
+	}
+
+	type result struct {
+		Type     string `json:"type"`
+		Name     string `json:"name"`
+		Expected string `json:"expected"`
+		Verified bool   `json:"verified"`
+		Detail   string `json:"detail"`
+		Proxied  bool   `json:"proxied"`
+	}
+
+	results := make([]result, 0, len(expected))
+	verified := 0
+	for _, record := range expected {
+		ok, detail := a.verifier.VerifyRecord(r.Context(), record)
+		if ok {
+			verified++
+		}
+		results = append(results, result{
+			Type:     record.Type,
+			Name:     record.Name,
+			Expected: record.Value,
+			Verified: ok,
+			Detail:   detail,
+			// Reported so the console can explain why a proxied record is
+			// checked for presence only: behind a proxy the published answer
+			// is the provider's address, never the value we asked for.
+			Proxied: record.Proxied,
+		})
+	}
+
+	status := "VERIFIED"
+	switch {
+	case len(results) == 0:
+		status = "UNKNOWN"
+	case verified == 0:
+		status = "MISSING"
+	case verified < len(results):
+		status = "PARTIAL"
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"domain":   domain,
+		"status":   status,
+		"verified": verified,
+		"total":    len(results),
+		"records":  results,
+	})
+}
+
+// SetAdminDnsAPI wires per-record DNS verification. Without a session secret
+// the route answers 503 rather than opening unauthenticated.
+func (r *Router) SetAdminDnsAPI(spec DnsSpecSource, verifier DnsRecordVerifier, sessionSecret string) {
+	if spec == nil || verifier == nil || sessionSecret == "" {
+		return
+	}
+	r.dns = &adminDnsAPI{spec: spec, verifier: verifier, sessions: NewWebSessionVerifier(sessionSecret)}
+}
+
+func (r *Router) handleAdminDnsVerify(w http.ResponseWriter, req *http.Request) {
+	if r.dns == nil {
+		writeError(w, http.StatusServiceUnavailable, "DNS_API_DISABLED",
+			"DNS verification needs JWT_SECRET and a configured domain")
+		return
+	}
+	r.dns.handleVerify(w, req)
+}