feat(apply): per-record selection + deletes-before-updates ordering

RecordDiff.Key() gives a stable normalized identifier ("TYPE name.") for
every diff kind, exposed as recordView.Key. ApplyRequest now takes
Updates/Prunes key lists instead of two booleans, so callers can apply a
subset of records. service.Apply builds the applied set with selected
prunes (Delete) added before selected updates (Add/Update) — an
invariant, not an option — since the provider rejects an Add/Update
whose name still conflicts with an existing record (e.g. a CNAME cannot
be created while an A on the same name still exists).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/diff/diff.go

@@ -21,6 +21,14 @@ type RecordDiff struct {
 	ReadOnly bool          // NS/SOA — shown but never applied
 }
 
+// Key is the stable identifier of the RRset this diff targets, normalised the
+// same way as model.Record.Key ("TYPE name."). Used to select individual diffs
+// for a partial apply. Works for every Kind (Delete has no Desired, Add has no
+// Actual) because Type/Name are always populated.
+func (d RecordDiff) Key() string {
+	return model.Record{Type: d.Type, Name: d.Name}.Key()
+}
+
 type Changeset struct {
 	Diffs []RecordDiff
 }

internal/diff/diff_test.go

@@ -22,6 +22,16 @@ func find(cs Changeset, key string) *RecordDiff {
 	return nil
 }
 
+// TestRecordDiffKeyNormalizes pins RecordDiff.Key() down to the same
+// normalization as model.Record.Key() (lowercase + trailing dot), for a
+// Delete diff (which has no Desired, only Type/Name populated directly).
+func TestRecordDiffKeyNormalizes(t *testing.T) {
+	d := RecordDiff{Kind: Delete, Type: model.A, Name: "Mail.Example.COM"}
+	if got := d.Key(); got != "A mail.example.com." {
+		t.Fatalf("key: %q", got)
+	}
+}
+
 func TestDiffAddUpdateDeleteInSync(t *testing.T) {
 	tmpl := []model.Record{
 		{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}}, // in sync