Dmarc Upgrade

Return the server-gated DMARC enforcement record for body.domain.

The REST twin of the build_dmarc_upgrade MCP tool, running the SAME core (mcp_server/tools.py::build_dmarc_upgrade_from_domain) rather than a second implementation, so the two agent transports cannot drift: the record is build_upgrade_record output byte for byte, and the ceiling is p=quarantine, unlocked by a server-side alignment gate — a caller cannot assert alignment to buy a stronger policy, and p=reject is not reachable from any scan (D101: only the readiness engine's aggregate-report evidence unlocks it).

Anonymous allowed. Scans fresh (see the core's docstring for why a stale baseline is silently destructive here), which is why this path carries the same enforce_v1_rate_limit and per-target scan budget the scan routes do.

record: null is an ANSWER, not an error: the domain does not exist, DMARC could not be read, the published policy is already at least as strong as this scan justifies, or the scan observed no alignment signal at all — the D101 reporting-first refusal, whose rationale asks for rua= reporting rather than offering a weaker record. Relay rationale; never compose a record to fill it.

Error mapping — the transport-neutral core errors become HTTP: ToolInputError → 422 with the core's own detail, ToolTransientError → 503 (retrying the identical call is the right response), and the pipeline's per-target budget → the same 429 both scan routes answer with. Suppression is refused here first, with the byte-identical 404 an unscanned domain gets, so the core's own suppression branch (a ToolInputError, which would surface as a 422) is never reached.