fix(api): surface real provider error on apply/check instead of generic internal error

resolve (shared by Check/Apply) and Apply now wrap GetRecords/ApplyChanges
failures in service.ErrProviderUnavailable, matching ZoneRecords' existing
behavior. handleApply/handleCheck use errors.Is against it to return 502
with the real provider message (e.g. Selectel's 409 conflict body) instead
of masking every failure as a generic 500 "internal error"; non-provider
errors (decrypt/db/loader) are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/service/service_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	"github.com/google/uuid"
@@ -26,8 +27,10 @@ func testCipher(t *testing.T) *crypto.Cipher {
 
 // fakeProvider records applied changesets and returns canned zone records.
 type fakeProvider struct {
-	actual  []model.Record
-	applied diff.Changeset
+	actual   []model.Record
+	applied  diff.Changeset
+	getErr   error // when set, GetRecords fails with this error
+	applyErr error // when set, ApplyChanges fails with this error
 }
 
 func (fakeProvider) Name() string { return "selectel" }
@@ -35,9 +38,15 @@ func (fakeProvider) ListZones(context.Context, provider.Credentials) ([]provider
 	return nil, nil
 }
 func (f *fakeProvider) GetRecords(context.Context, provider.Credentials, string) ([]model.Record, error) {
+	if f.getErr != nil {
+		return nil, f.getErr
+	}
 	return f.actual, nil
 }
 func (f *fakeProvider) ApplyChanges(_ context.Context, _ provider.Credentials, _ string, cs diff.Changeset) error {
+	if f.applyErr != nil {
+		return f.applyErr
+	}
 	f.applied = cs
 	return nil
 }
@@ -191,3 +200,49 @@ func TestApplySelectsByKeyAndOrdersPrunesBeforeUpdates(t *testing.T) {
 		t.Fatalf("expected update SECOND in applied order, got %+v", fp4.applied.Diffs)
 	}
 }
+
+// TestApplyWrapsProviderError covers the fix: a failure from the provider's
+// ApplyChanges call (e.g. Selectel rejecting a change with a 409 conflict)
+// must be wrapped in ErrProviderUnavailable so the API layer can tell it
+// apart from a local resolution failure and surface the real provider
+// message instead of a generic "internal error".
+func TestApplyWrapsProviderError(t *testing.T) {
+	actual := []model.Record{{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"9.9.9.9"}}}
+	tmpl := dto.TemplateDoc{Records: []dto.RecordDTO{
+		{Type: "A", Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}},
+	}}
+	svc, fp := setup(t, actual, tmpl)
+	fp.applyErr = errors.New("selectel POST /zones/z1/rrset: 409: conflicting CNAME record exists")
+
+	_, err := svc.Apply(context.Background(), uuid.New(), uuid.New(), ApplyRequest{Updates: []string{"A a.example.com."}})
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !errors.Is(err, ErrProviderUnavailable) {
+		t.Fatalf("expected error to wrap ErrProviderUnavailable, got %v", err)
+	}
+	msg := ProviderMessage(err)
+	if msg != "selectel POST /zones/z1/rrset: 409: conflicting CNAME record exists" {
+		t.Fatalf("expected clean provider message, got %q", msg)
+	}
+}
+
+// TestResolveWrapsProviderError covers the resolve helper shared by Check and
+// Apply: a GetRecords failure from the provider must also be wrapped in
+// ErrProviderUnavailable, mirroring ZoneRecords' existing behavior.
+func TestResolveWrapsProviderError(t *testing.T) {
+	svc, fp := setup(t, nil, dto.TemplateDoc{})
+	fp.getErr = errors.New("selectel GET /zones/z1/rrset: 503: upstream unavailable")
+
+	_, err := svc.Check(context.Background(), uuid.New(), uuid.New())
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !errors.Is(err, ErrProviderUnavailable) {
+		t.Fatalf("expected error to wrap ErrProviderUnavailable, got %v", err)
+	}
+	msg := ProviderMessage(err)
+	if msg != "selectel GET /zones/z1/rrset: 503: upstream unavailable" {
+		t.Fatalf("expected clean provider message, got %q", msg)
+	}
+}