feat(store): persist per-domain custom record marks

internal/store/tenant.go

@@ -245,6 +245,34 @@ func (s *Store) SetDomainTemplate(ctx context.Context, domainID, projectID uuid.
 	return domainFromDB(d), nil
 }
 
+// AddCustomRecord marks an RRset (identified by its diff key, "TYPE name.")
+// as deliberately kept outside the template for this domain. Idempotent.
+// The scoped GetDomain first ensures the domain belongs to projectID —
+// otherwise a foreign domain could be marked (IDOR-on-write), same guard
+// SetDomainTemplate uses for templates.
+func (s *Store) AddCustomRecord(ctx context.Context, domainID, projectID uuid.UUID, key string) error {
+	if _, err := s.GetDomain(ctx, domainID, projectID); err != nil {
+		return err
+	}
+	return s.q.AddCustomRecord(ctx, db.AddCustomRecordParams{DomainID: domainID, RecordKey: key})
+}
+
+// DeleteCustomRecord removes the mark, returning the record to the regular
+// diff. Scoped by projectID for the same reason as AddCustomRecord.
+func (s *Store) DeleteCustomRecord(ctx context.Context, domainID, projectID uuid.UUID, key string) error {
+	if _, err := s.GetDomain(ctx, domainID, projectID); err != nil {
+		return err
+	}
+	return s.q.DeleteCustomRecord(ctx, db.DeleteCustomRecordParams{DomainID: domainID, RecordKey: key})
+}
+
+// ListCustomKeys returns the marked record keys of a domain. Not scoped by
+// project on purpose: the only caller is LoadDomain, which has already
+// resolved the domain by (id, projectID).
+func (s *Store) ListCustomKeys(ctx context.Context, domainID uuid.UUID) ([]string, error) {
+	return s.q.ListCustomKeys(ctx, domainID)
+}
+
 // GetDomainStatus returns the last known check status for a domain (Фаза 3
 // scheduler/checker). Callers scope access to the domain themselves (e.g.
 // via a prior GetDomain) — this lookup is by primary key alone.