refactor(models): split Site into SiteConfig + SiteState

Site now embeds SiteConfig (22 persistent fields) and SiteState
(11 ephemeral runtime fields). Field access unchanged via promotion
— site.Name and site.Status still work.

Store layer deals exclusively in SiteConfig — the DB never sees
runtime state. Engine's liveState keeps full Site composites.
UpdateSiteConfig reduced from 11-line field-by-field copy to
`existing.SiteConfig = cfg`.

RunCheck takes SiteConfig (only needs config fields). Checker is
now statically prevented from reading/writing runtime state.

Backup.Sites changed to []SiteConfig — exports no longer carry
zero-valued runtime fields. Import backward-compatible (json
ignores unknown fields).

internal/tui/format_test.go

@@ -38,13 +38,13 @@ func TestSiteOrder(t *testing.T) {
 		site models.Site
 		want int
 	}{
-		{"down", models.Site{Status: "DOWN"}, 0},
-		{"ssl exp", models.Site{Status: "SSL EXP"}, 0},
-		{"late", models.Site{Status: "LATE"}, 1},
-		{"up", models.Site{Status: "UP"}, 2},
-		{"pending", models.Site{Status: "PENDING"}, 3},
-		{"paused up", models.Site{Status: "UP", Paused: true}, 3},
-		{"paused down", models.Site{Status: "DOWN", Paused: true}, 3},
+		{"down", models.Site{SiteState: models.SiteState{Status: "DOWN"}}, 0},
+		{"ssl exp", models.Site{SiteState: models.SiteState{Status: "SSL EXP"}}, 0},
+		{"late", models.Site{SiteState: models.SiteState{Status: "LATE"}}, 1},
+		{"up", models.Site{SiteState: models.SiteState{Status: "UP"}}, 2},
+		{"pending", models.Site{SiteState: models.SiteState{Status: "PENDING"}}, 3},
+		{"paused up", models.Site{SiteConfig: models.SiteConfig{Paused: true}, SiteState: models.SiteState{Status: "UP"}}, 3},
+		{"paused down", models.Site{SiteConfig: models.SiteConfig{Paused: true}, SiteState: models.SiteState{Status: "DOWN"}}, 3},
 	}
 	for _, tt := range tests {
 		got := siteOrder(tt.site)