fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/scheduler/scheduler.go

@@ -14,17 +14,21 @@ import (
 	"github.com/vasyakrg/dns-autoresolver/internal/diff"
 	"github.com/vasyakrg/dns-autoresolver/internal/metrics"
 	"github.com/vasyakrg/dns-autoresolver/internal/notify"
+	"github.com/vasyakrg/dns-autoresolver/internal/service"
 	"github.com/vasyakrg/dns-autoresolver/internal/store"
 )
 
 // Domain check statuses persisted via SchedStore.SetDomainStatus /
 // surfaced via GetDomainStatus. "unknown" is the DB default for a domain
 // that has never been checked (see migrations/0004_schedule_notify.sql).
+// Aliased from internal/service — the single source of truth shared with the
+// manual check handler (internal/api), so both paths persist the same
+// values.
 const (
-	StatusUnknown = "unknown"
-	StatusInSync  = "in_sync"
-	StatusDrift   = "drift"
-	StatusError   = "error"
+	StatusUnknown = service.StatusUnknown
+	StatusInSync  = service.StatusInSync
+	StatusDrift   = service.StatusDrift
+	StatusError   = service.StatusError
 )
 
 // SchedStore is the narrow store dependency the scheduler needs: due