feat(api): read zone records without template + snapshot-to-template

LoadDomain requires a template, so a zone without one could never be
viewed or snapshotted. Adds a template-free path: store.LoadZone /
service.ZoneRef / DomainService.ZoneRecords read a zone's live records
straight from the provider (no diff, no template). GET
/domains/{did}/records exposes read-only viewing; POST
/domains/{did}/template-from-zone snapshots only managed record types
(NS/SOA excluded) into a new template and auto-attaches it to the domain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/store/loader_test.go

@@ -91,3 +91,35 @@ func TestLoadDomainNoTemplate(t *testing.T) {
 		t.Fatal("expected error for domain without template, got nil")
 	}
 }
+
+// TestLoadZoneNoTemplate covers the Task 1 gap: a domain with no attached
+// template must still be resolvable to its provider-access ref (ZoneRef) so
+// its live records can be read/snapshotted — unlike LoadDomain, LoadZone
+// must NOT error out on a nil template doc.
+func TestLoadZoneNoTemplate(t *testing.T) {
+	s, ctx := newStore(t)
+
+	acc, err := s.Queries().CreateAccount(ctx, db.CreateAccountParams{
+		ID: uuid.New(), ProjectID: defaultProject,
+		Provider: "selectel", SecretEnc: "enc-blob", Comment: "prod",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	domain, err := s.Queries().CreateDomain(ctx, db.CreateDomainParams{
+		ID: uuid.New(), ProjectID: defaultProject, ProviderAccountID: acc.ID,
+		ZoneName: "example.com", ZoneID: "zone-3", TemplateID: nil,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ref, err := s.LoadZone(ctx, defaultProject, domain.ID)
+	if err != nil {
+		t.Fatalf("expected LoadZone to succeed without a template, got error: %v", err)
+	}
+	if ref.ZoneID != "zone-3" || ref.Provider != "selectel" || ref.SecretEnc != "enc-blob" {
+		t.Fatalf("zone ref mismatch: %+v", ref)
+	}
+}