feat(apply): per-record selection + deletes-before-updates ordering

RecordDiff.Key() gives a stable normalized identifier ("TYPE name.") for
every diff kind, exposed as recordView.Key. ApplyRequest now takes
Updates/Prunes key lists instead of two booleans, so callers can apply a
subset of records. service.Apply builds the applied set with selected
prunes (Delete) added before selected updates (Add/Update) — an
invariant, not an option — since the provider rejects an Add/Update
whose name still conflicts with an existing record (e.g. a CNAME cannot
be created while an A on the same name still exists).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/service/service.go

@@ -50,8 +50,8 @@ type Recorder interface {
 }
 
 type ApplyRequest struct {
-	ApplyUpdates bool
-	ApplyPrunes  bool
+	Updates []string // record keys (RecordDiff.Key) to add/update
+	Prunes  []string // record keys to delete
 }
 
 type DomainService struct {
@@ -128,18 +128,29 @@ func (s *DomainService) ZoneRecords(ctx context.Context, projectID, domainID uui
 	return recs, nil
 }
 
-// Apply applies updates always (when ApplyUpdates) and prunes only when ApplyPrunes.
+// Apply applies exactly the diffs whose keys are selected in req.Updates and
+// req.Prunes. Selected prunes are added to the applied set BEFORE selected
+// updates: deletes first is an invariant, not an option — the provider
+// rejects an Add/Update whose name still has a conflicting record (e.g. a
+// CNAME cannot be created while an A on the same name exists), so pruning the
+// old records before applying updates avoids that.
 func (s *DomainService) Apply(ctx context.Context, projectID, domainID uuid.UUID, req ApplyRequest) (diff.Changeset, error) {
 	p, creds, ref, cs, err := s.resolve(ctx, projectID, domainID)
 	if err != nil {
 		return diff.Changeset{}, err
 	}
+	selPrunes := toSet(req.Prunes)
+	selUpdates := toSet(req.Updates)
 	var toApply []diff.RecordDiff
-	if req.ApplyUpdates {
-		toApply = append(toApply, cs.Updates()...)
+	for _, d := range cs.Prunes() {
+		if selPrunes[d.Key()] {
+			toApply = append(toApply, d)
+		}
 	}
-	if req.ApplyPrunes {
-		toApply = append(toApply, cs.Prunes()...)
+	for _, d := range cs.Updates() {
+		if selUpdates[d.Key()] {
+			toApply = append(toApply, d)
+		}
 	}
 	applied := diff.Changeset{Diffs: toApply}
 	if len(toApply) > 0 {
@@ -149,3 +160,11 @@ func (s *DomainService) Apply(ctx context.Context, projectID, domainID uuid.UUID
 	}
 	return applied, nil
 }
+
+func toSet(keys []string) map[string]bool {
+	m := make(map[string]bool, len(keys))
+	for _, k := range keys {
+		m[k] = true
+	}
+	return m
+}