fix: document apply ordering invariant; visible indeterminate checkbox + test

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/provider/provider.go

@@ -25,6 +25,12 @@ type Provider interface {
 	Name() string
 	ListZones(ctx context.Context, creds Credentials) ([]Zone, error)
 	GetRecords(ctx context.Context, creds Credentials, zoneID string) ([]model.Record, error)
+	// ApplyChanges MUST apply cs.Diffs in the order they are given and must
+	// not reorder or group them by Kind. The caller (service.Apply)
+	// deliberately places Delete diffs before Add/Update diffs, because some
+	// providers (e.g. Selectel) reject creating a CNAME on a name where a
+	// conflicting A record still exists. Implementations should apply diffs
+	// sequentially in the given order rather than batching by kind.
 	ApplyChanges(ctx context.Context, creds Credentials, zoneID string, cs diff.Changeset) error
 	// Validate checks the credentials are usable (e.g. a trial auth), so a
 	// bad account is rejected at creation time rather than at first import.