fix(store,api): идемпотентный import (UNIQUE+ON CONFLICT) + PATCH привязки шаблона к домену

internal/api/tenant_handlers.go

@@ -304,6 +304,40 @@ func (a *API) handleListDomains(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, resp)
 }
 
+// handleSetDomainTemplate binds (or clears) the DNS template used to
+// check/apply a domain — this is what makes an imported domain (which
+// starts with template_id=NULL) checkable, closing the import→check loop.
+func (a *API) handleSetDomainTemplate(w http.ResponseWriter, r *http.Request) {
+	pid, err := uuid.Parse(chi.URLParam(r, "pid"))
+	if err != nil {
+		writeErr(w, http.StatusBadRequest, "invalid project id")
+		return
+	}
+	did, err := uuid.Parse(chi.URLParam(r, "did"))
+	if err != nil {
+		writeErr(w, http.StatusBadRequest, "invalid domain id")
+		return
+	}
+	var req updateDomainTemplateRequest
+	if !decodeBody(w, r, &req) {
+		return
+	}
+	templateID, ok := parseOptionalUUID(req.TemplateID)
+	if !ok {
+		writeErr(w, http.StatusBadRequest, "invalid templateId")
+		return
+	}
+
+	dom, err := a.Store.SetDomainTemplate(r.Context(), did, pid, templateID)
+	if err != nil {
+		// Either the domain itself or the (scoped) template wasn't found in
+		// this project — treat both as 404 rather than leak which one.
+		writeErr(w, http.StatusNotFound, "domain or template not found")
+		return
+	}
+	writeJSON(w, http.StatusOK, toDomainResponse(dom))
+}
+
 func (a *API) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 	pid, err := uuid.Parse(chi.URLParam(r, "pid"))
 	if err != nil {