feat(service): apply custom marks to the computed diff

internal/service/service.go

@@ -41,6 +41,11 @@ type DomainRef struct {
 	Provider  string
 	SecretEnc string
 	Template  dto.TemplateDoc
+	// CustomKeys are RecordDiff keys the operator marked as deliberately
+	// outside the template for this domain. Applied in resolve() right after
+	// the diff is computed — the single marking point, like tmpl.Materialize
+	// is the single materialisation point.
+	CustomKeys []string
 }
 
 // ZoneRef is the provider-access subset of a domain, without a template —
@@ -102,6 +107,7 @@ func (s *DomainService) resolve(ctx context.Context, projectID, domainID uuid.UU
 		return nil, provider.Credentials{}, ref, diff.Changeset{}, fmt.Errorf("%w: %v", ErrProviderUnavailable, err)
 	}
 	cs := diff.Diff(tmpl.Materialize(ref.Template, ref.ZoneName), actual)
+	cs.MarkCustom(ref.CustomKeys)
 	return p, creds, ref, cs, nil
 }