Wire source + domain_type filters into the browser domains list UI

## Problem

The domains list **API** can now filter by `source` and `domain_type` (#53, PR #77), but the **browser UI** cannot. The domains list page only offers:

- a name search box (`q` signal → `FilterName`), and
- a "top-level" dropdown that is an **in-memory apex-family filter** (`apexOf(row.Name) == tld`), *not* a `domain_type` DB filter.

So there is no way in the UI to see, say, only `user_supplied` domains or only `tld`/`wildcard` rows. (Note: #53's description called the existing control a "TLD/domain_type filter" — that's a misnomer; it filters by registrable apex, a different concept from the `domain_type` enum.)

## Current state

- `handleDomainsGet` (`internal/ui/domain_handlers.go:42`) reads `q` / `layout` / `tld` signals (`:53-75`) and passes only `FilterName: query` to `DomainsService().List` (`:82`).
- The `tld` narrowing happens **in Go** over the already-fetched rows (`:124-135`), capped at `maxListDomains = 5000` (`:29`).
- The filter control lives in `internal/ui/templates/domains.templ:53-57` (``), populated from `distinctApexes(rows)` (`internal/ui/domain_grouping.go:146`).
- The service already supports the cuts: `service.DomainsListParams{Source, DomainType}` are validated against the `domain_source` / `domain_type` enums and reject unknown values with `ErrInvalidInput` (shipped in #77).

## Proposed change

1. Add two `` controls to `domains.templ` (mirroring the existing `tld` select) bound to new `source` / `domainType` signals, each firing `$offset = 0; @get('/app/domains')` on change. Options come from the fixed enum values (`user_supplied`/`discovered`; `tld`/`subdomain`/`wildcard`/`old`/`other`).
2. Read the new signals in `handleDomainsGet` (both the URL-query and the datastar-signals block) and pass `Source`/`DomainType` into the existing `List` call.
3. Push the new cuts to the DB query (the service already does this via `DomainsList`). The in-memory apex (`tld`) narrowing stays as-is; the three filters AND together. This makes `total_count` / result-meta reflect the filtered set and applies the 5000 cap *after* filtering.
4. Add an `ErrInvalidInput` branch to `handleDomainsGet`'s error handling (currently any `List` error → 500). Defensive only, since the dropdowns emit fixed values.
5. Tests: UI handler test asserting `source` / `domain_type` narrow the rendered rows and result-meta, and that they compose with the apex filter and name search.

## Notes

- **Performance:** a net win — moving the cuts into the query is cheaper than fetching up to 5000 rows and filtering in Go, and the equality filters ride the existing `idx_domains_source` / `idx_domains_type` indexes (already scoped under `tenant_id`).
- **Datastar gotcha:** use the colon keyed-attr form (`data-on:change`, `data-bind`), not hyphenated variants.
- **Other `List` call sites** in `internal/ui/domain_handlers.go` (e.g. the picker/secondary views) are out of scope; this issue is the main domains list page only.

Start with handleDomainsGet in internal/ui/domain_handlers.go and the domains controls in internal/ui/templates/domains.templ; trace the existing tld signal and List call before adding the two new paths. Run the UI handler tests, then verify source and domain_type narrow rows and result metadata, compose with the apex and name filters, and return invalid input correctly.

Written by the indexing model from the issue text.