fix: reject snapshot when template already attached (409); handle domains-load error; drop orphaned useDeleteDomain

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/api/tenant_test.go

@@ -689,6 +689,35 @@ func TestTemplateFromZone_SnapshotsManagedRecordsOnlyAndAttaches(t *testing.T) {
 	}
 }
 
+// TestTemplateFromZone_AlreadyAttachedReturns409 covers the guard against
+// re-snapshotting a domain that already has a template bound: a direct
+// POST (e.g. curl or a client retry) must not silently create a new
+// template and re-point the domain, orphaning the previously attached one.
+func TestTemplateFromZone_AlreadyAttachedReturns409(t *testing.T) {
+	a, ts := newTenantTestAPI()
+	domID := uuid.New()
+	existingTemplateID := uuid.New()
+	ts.domains = []store.Domain{{ID: domID, ZoneName: "example.com", ZoneID: "z1", TemplateID: &existingTemplateID}}
+	a.Svc = &mockCheckApplier{zoneRecords: []model.Record{
+		{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}},
+	}}
+	router := NewRouter(a)
+
+	req := requestWithSessionCookie(http.MethodPost, "/api/v1/projects/"+testPID+"/domains/"+domID.String()+"/template-from-zone", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusConflict {
+		t.Fatalf("status %d body %s", w.Code, w.Body.String())
+	}
+	if ts.createTemplate != nil {
+		t.Fatalf("expected CreateTemplate NOT to be called, got %+v", ts.createTemplate)
+	}
+	if ts.domains[0].TemplateID == nil || *ts.domains[0].TemplateID != existingTemplateID {
+		t.Fatalf("expected existing template binding untouched, got %+v", ts.domains[0].TemplateID)
+	}
+}
+
 // TestZoneRecords_ProviderErrorReturns502 covers the provider-failure path:
 // an error wrapping service.ErrProviderUnavailable (i.e. GetRecords itself
 // failed) must surface as 502 (bad gateway), not a generic 500 or 404.