Flatten compliance portal package layout

Remove the root complianceportal package and the resolver
facade that existed only to break an IAM import cycle. Admin
policies, domain URL helpers, and actions live under
management; visitor OAuth metadata, brand URLs, and public
read paths live under visitor. Drop the duplicate trust API
magic-link mutations now that Connect handles portal auth, and
stop IAM from owning compliance page email branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/mailman/compliance_mailing_list.go

@@ -29,7 +29,6 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/packages/emails"
 	"go.probo.inc/probo/pkg/baseurl"
-	"go.probo.inc/probo/pkg/complianceportal/resolver"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/mail"
@@ -98,12 +97,11 @@ func (s *Service) mailingListEmailConfig(
 				return fmt.Errorf("cannot load organization: %w", err)
 			}
 
-			publicURL, err := resolver.PublicURLForTrustCenter(
+			publicURL, err := s.compliancePortal.PublicURLForCompliancePage(
 				ctx,
 				conn,
 				scope,
 				compliancePage,
-				s.trustCenterBaseDomain,
 			)
 			if err != nil {
 				return fmt.Errorf("cannot resolve compliance page URL: %w", err)

pkg/mailman/service.go

@@ -30,6 +30,7 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/packages/emails"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/crypto/cipher"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -51,14 +52,14 @@ const (
 )
 
 type Service struct {
-	pg                    *pg.Client
-	fm                    *filemanager.Service
-	tokenSecret           string
-	apiBaseURL            *baseurl.BaseURL
-	trustCenterBaseDomain string
-	bucket                string
-	encryptionKey         cipher.EncryptionKey
-	logger                *log.Logger
+	pg               *pg.Client
+	fm               *filemanager.Service
+	tokenSecret      string
+	apiBaseURL       *baseurl.BaseURL
+	compliancePortal *management.Service
+	bucket           string
+	encryptionKey    cipher.EncryptionKey
+	logger           *log.Logger
 }
 
 func NewService(
@@ -66,20 +67,20 @@ func NewService(
 	fm *filemanager.Service,
 	tokenSecret string,
 	apiBaseURL *baseurl.BaseURL,
-	trustCenterBaseDomain string,
+	compliancePortal *management.Service,
 	bucket string,
 	encryptionKey cipher.EncryptionKey,
 	logger *log.Logger,
 ) *Service {
 	return &Service{
-		pg:                    pgClient,
-		fm:                    fm,
-		tokenSecret:           tokenSecret,
-		apiBaseURL:            apiBaseURL,
-		trustCenterBaseDomain: trustCenterBaseDomain,
-		bucket:                bucket,
-		encryptionKey:         encryptionKey,
-		logger:                logger,
+		pg:               pgClient,
+		fm:               fm,
+		tokenSecret:      tokenSecret,
+		apiBaseURL:       apiBaseURL,
+		compliancePortal: compliancePortal,
+		bucket:           bucket,
+		encryptionKey:    encryptionKey,
+		logger:           logger,
 	}
 }