feat(api): read zone records without template + snapshot-to-template

LoadDomain requires a template, so a zone without one could never be
viewed or snapshotted. Adds a template-free path: store.LoadZone /
service.ZoneRef / DomainService.ZoneRecords read a zone's live records
straight from the provider (no diff, no template). GET
/domains/{did}/records exposes read-only viewing; POST
/domains/{did}/template-from-zone snapshots only managed record types
(NS/SOA excluded) into a new template and auto-attaches it to the domain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/api/api_test.go

@@ -17,7 +17,9 @@ import (
 )
 
 type mockCheckApplier struct {
-	lastReq service.ApplyRequest
+	lastReq     service.ApplyRequest
+	zoneRecords []model.Record
+	zoneErr     error
 }
 
 func (m *mockCheckApplier) Check(context.Context, uuid.UUID, uuid.UUID) (diff.Changeset, error) {
@@ -28,6 +30,12 @@ func (m *mockCheckApplier) Apply(_ context.Context, _, _ uuid.UUID, req service.
 	m.lastReq = req
 	return diff.Changeset{}, nil
 }
+func (m *mockCheckApplier) ZoneRecords(context.Context, uuid.UUID, uuid.UUID) ([]model.Record, error) {
+	if m.zoneErr != nil {
+		return nil, m.zoneErr
+	}
+	return m.zoneRecords, nil
+}
 
 // newTestAPI wires a fixed authenticated user who owns whatever project id
 // is requested (via alwaysOwnedAuthStore/alwaysValidSessions in