fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/api/handlers.go

@@ -37,10 +37,20 @@ func (a *API) handleCheck(w http.ResponseWriter, r *http.Request) {
 	}
 	cs, err := a.Svc.Check(r.Context(), pid, did)
 	if err != nil {
+		// Persist the failure so the domain badge reflects it instead of stale
+		// "unknown"; the write error (if any) is logged, never masks the 500.
+		if serr := a.Store.SetDomainStatus(r.Context(), did, service.StatusError); serr != nil {
+			log.Printf("api: set domain status (error) failed: %v", serr)
+		}
 		log.Printf("api: check failed: %v", err)
 		writeErr(w, http.StatusInternalServerError, "internal error")
 		return
 	}
+	// Manual check persists status/history only — no notification. Notify
+	// remains the scheduler's responsibility (see internal/scheduler).
+	if serr := a.Store.SetDomainStatus(r.Context(), did, service.DeriveStatus(cs)); serr != nil {
+		log.Printf("api: set domain status failed: %v", serr)
+	}
 	writeJSON(w, http.StatusOK, toChangesetResponse(cs))
 }