refactor(models): split Site into SiteConfig + SiteState

Site now embeds SiteConfig (22 persistent fields) and SiteState
(11 ephemeral runtime fields). Field access unchanged via promotion
— site.Name and site.Status still work.

Store layer deals exclusively in SiteConfig — the DB never sees
runtime state. Engine's liveState keeps full Site composites.
UpdateSiteConfig reduced from 11-line field-by-field copy to
`existing.SiteConfig = cfg`.

RunCheck takes SiteConfig (only needs config fields). Checker is
now statically prevented from reading/writing runtime state.

Backup.Sites changed to []SiteConfig — exports no longer carry
zero-valued runtime fields. Import backward-compatible (json
ignores unknown fields).

internal/metrics/prometheus_test.go

@@ -15,16 +15,16 @@ import (
 
 type mockStore struct {
 	storetest.BaseMock
-	sites []models.Site
+	sites []models.SiteConfig
 }
 
-func (m *mockStore) GetSites(_ context.Context) ([]models.Site, error) {
+func (m *mockStore) GetSites(_ context.Context) ([]models.SiteConfig, error) {
 	return m.sites, nil
 }
 
 func TestMetricsHandler(t *testing.T) {
 	ms := &mockStore{
-		sites: []models.Site{
+		sites: []models.SiteConfig{
 			{ID: 1, Name: "Example", URL: "https://example.com", Type: "http", Interval: 30},
 			{ID: 2, Name: "DNS Check", Type: "dns", Interval: 60},
 		},