Fix DKIM selector extraction: show all working selectors and report-discovered selectors

- check_dkim now returns ALL matching selectors instead of stopping at first match
- DomainDNSResult.dkim_selectors is now a List[str] instead of a single Optional[str]
- DNSRecordResponse.dkimSelectors is now List[str]
- /selectors endpoint now also returns report_selectors (auto-discovered from DMARC reports)
- Frontend shows all live-check selectors and auto-discovered selectors as read-only
- Updated tests to match new data structures; added tests for multi-selector and report_selectors

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/87d8b8d9-23c3-4d3b-85a3-8e354e62c768

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/tests/test_dns_endpoints.py

@@ -49,7 +49,7 @@ MOCK_DNS_RESULT = DomainDNSResult(
     spf=True,
     spf_record="v=spf1 include:_spf.google.com ~all",
     dkim=True,
-    dkim_selector="google",
+    dkim_selectors=["google"],
     dkim_record="v=DKIM1; k=rsa; p=ABC",
 )
 
@@ -79,7 +79,9 @@ def test_get_selectors_empty(client: TestClient):
     """Returns an empty list when no selectors have been configured."""
     response = client.get(f"/api/v1/domains/{DOMAIN}/selectors")
     assert response.status_code == 200
-    assert response.json() == {"selectors": []}
+    data = response.json()
+    assert data["selectors"] == []
+    assert "report_selectors" in data
 
 
 def test_get_selectors_unknown_domain(client: TestClient):
@@ -176,6 +178,42 @@ def test_delete_selector_unknown_domain(client: TestClient):
 # ---------------------------------------------------------------------------
 
 
+def test_get_selectors_includes_report_selectors(client: TestClient):
+    """Report selectors (from DMARC report records) are returned in report_selectors."""
+    response = client.get(f"/api/v1/domains/{DOMAIN}/selectors")
+    assert response.status_code == 200
+    data = response.json()
+    # The MINIMAL_REPORT has a record with selector "google" in its dkim auth results
+    assert "google" in data["report_selectors"]
+
+
+def test_get_selectors_report_selector_moves_to_manual_when_added(client: TestClient):
+    """A selector discovered from reports should appear only in 'selectors' once added manually."""
+    # Confirm it's in report_selectors before adding
+    r1 = client.get(f"/api/v1/domains/{DOMAIN}/selectors")
+    assert "google" in r1.json()["report_selectors"]
+
+    # Add it as a manual selector
+    client.post(f"/api/v1/domains/{DOMAIN}/selectors", json={"selector": "google"})
+
+    r2 = client.get(f"/api/v1/domains/{DOMAIN}/selectors")
+    data = r2.json()
+    assert "google" in data["selectors"]
+    # It must not appear in both lists
+    assert "google" not in data["report_selectors"]
+
+
+def test_dns_endpoint_returns_dkim_selectors_as_list(client: TestClient):
+    """The /dns endpoint should return dkimSelectors as a list."""
+    with _mock_dns():
+        response = client.get(f"/api/v1/domains/{DOMAIN}/dns")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert isinstance(data["dkimSelectors"], list)
+    assert "google" in data["dkimSelectors"]
+
+
 def test_dns_endpoint_returns_real_data(client: TestClient):
     """The /dns endpoint should return the mocked DNS check result."""
     with _mock_dns():