fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/api/api.go

@@ -50,6 +50,10 @@ type TenantStore interface {
 	DeleteDomain(ctx context.Context, id, projectID uuid.UUID) error
 	ImportDomains(ctx context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]store.Domain, error)
 	SetDomainTemplate(ctx context.Context, domainID, projectID uuid.UUID, templateID *uuid.UUID) (store.Domain, error)
+	// SetDomainStatus persists the outcome of a manual check (handleCheck) so
+	// the domain's badge reflects reality immediately, instead of staying
+	// "unknown" until the scheduler's next tick.
+	SetDomainStatus(ctx context.Context, domainID uuid.UUID, status string) error
 }
 
 // Cipher encrypts/decrypts provider account secrets. *crypto.Cipher satisfies it.