fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/service/status.go

@@ -0,0 +1,24 @@
+package service
+
+import "github.com/vasyakrg/dns-autoresolver/internal/diff"
+
+// Domain check statuses persisted in domains.last_check_status. "unknown" is
+// the DB default for a domain that has never been checked. Single source of
+// truth — the scheduler aliases these, the API check handler writes them.
+const (
+	StatusUnknown = "unknown"
+	StatusInSync  = "in_sync"
+	StatusDrift   = "drift"
+	StatusError   = "error"
+)
+
+// DeriveStatus maps a successful check's changeset to a domain status:
+// actionable drift (managed adds/updates/prunes) → "drift", otherwise
+// "in_sync". A failed check (provider/loader error) is "error" and handled by
+// the caller, which has the error in hand.
+func DeriveStatus(cs diff.Changeset) string {
+	if len(cs.Actionable()) > 0 {
+		return StatusDrift
+	}
+	return StatusInSync
+}