fix(api): manual check persists last_check_status (was stale unknown)

Manual domain checks (Recheck button / diff page load) never wrote
domains.last_check_status - only the scheduler did, leaving a
newly-templated domain stuck at "unknown" until the next scheduled run.

Extract status derivation into internal/service (single source of truth):
StatusUnknown/InSync/Drift/Error constants and DeriveStatus(diff.Changeset).
The scheduler now aliases these constants instead of duplicating them.
handleCheck persists the derived status (or StatusError on failure) via
TenantStore.SetDomainStatus after every manual check - status/history only,
no notification, which remains the scheduler's job.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/service/status_test.go

@@ -0,0 +1,23 @@
+package service_test
+
+import (
+	"testing"
+
+	"github.com/vasyakrg/dns-autoresolver/internal/diff"
+	"github.com/vasyakrg/dns-autoresolver/internal/model"
+	"github.com/vasyakrg/dns-autoresolver/internal/service"
+)
+
+func TestDeriveStatus(t *testing.T) {
+	// no actionable diffs → in_sync
+	if got := service.DeriveStatus(diff.Changeset{}); got != service.StatusInSync {
+		t.Fatalf("empty: %q", got)
+	}
+	// an actionable prune → drift
+	cs := diff.Changeset{Diffs: []diff.RecordDiff{
+		{Kind: diff.Delete, Type: model.A, Name: "x.example.com.", Actual: &model.Record{Type: model.A, Name: "x.example.com.", Values: []string{"1.1.1.1"}}},
+	}}
+	if got := service.DeriveStatus(cs); got != service.StatusDrift {
+		t.Fatalf("prune: %q", got)
+	}
+}