fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/api/tenant_test.go

@@ -39,6 +39,14 @@ type mockTenantStore struct {
 	importCalled     bool
 
 	setDomainTemplateErr error
+
+	// statusCalls records every SetDomainStatus(domainID, status) call, in
+	// order, so tests can assert what the handler persisted.
+	statusCalls []struct {
+		domainID uuid.UUID
+		status   string
+	}
+	setDomainStatusErr error
 }
 
 func (m *mockTenantStore) CreateAccount(_ context.Context, projectID uuid.UUID, prov, secretEnc, comment string) (store.Account, error) {
@@ -126,6 +134,16 @@ func (m *mockTenantStore) SetDomainTemplate(_ context.Context, domainID, project
 	return d, nil
 }
 
+// SetDomainStatus records the call for assertion instead of actually mutating
+// m.domains — handleCheck tests only need to verify what was written.
+func (m *mockTenantStore) SetDomainStatus(_ context.Context, domainID uuid.UUID, status string) error {
+	m.statusCalls = append(m.statusCalls, struct {
+		domainID uuid.UUID
+		status   string
+	}{domainID, status})
+	return m.setDomainStatusErr
+}
+
 func (m *mockTenantStore) ImportDomains(_ context.Context, projectID, accountID uuid.UUID, zones []provider.Zone) ([]store.Domain, error) {
 	m.importCalled = true
 	if m.importDomainsErr != nil {