fix(24): address code-review findings — PATCH identity guard, empty-array tombstone, health-check timeout, record-key normalization

Two critical issues from the post-phase code review:

- PATCH /api/route53/zones/[zoneId]/records/[recordId] never verified the
  request body's name/type/setIdentifier matched the record identified by
  the URL. A mismatch would silently UPSERT a brand-new AWS recordset
  (leaving the original live and untouched) while corrupting the mirror's
  record_key invariant. Now rejects with 400 if any of those three fields
  differ from the existing record — renaming/retyping is delete-plus-create,
  not an update.

- route53-sync-service.ts's syncZones()/syncRecords() tombstone queries used
  "id <> ALL(seenIds)" style queries with no empty-array guard — a
  successful-but-empty AWS response would soft-delete every previously
  synced zone/record in one shot. Same bug class already fixed in
  pax8-sync-service.ts; now guarded the same way here.

Two smaller fixes:

- checkRoute53()'s AWS auth probe had no timeout, unlike every other
  integration's liveCheck() (8s AbortController). Added the same bound via
  the SDK's abortSignal option.
- buildRecordKey() relied on every caller to pre-normalize name/type case
  before calling it. Now normalizes internally (lowercase name, uppercase
  type) so the record_key invariant holds regardless of caller discipline.

Full REVIEW.md findings in 24-REVIEW.md. Two remaining Warnings (alias
records un-editable/undeletable, no admin-UI surface for route53_audit_log)
deliberately left as backlog items for a follow-up phase — out of scope for
a post-execution fix pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/route53/zones/[zoneId]/records/[recordId]/route.ts

@@ -91,6 +91,26 @@ export async function PATCH(
   if (!existing) {
     return NextResponse.json({ error: 'Record not found' }, { status: 404 });
   }
+
+  // name/type/setIdentifier are immutable via PATCH — Route 53 identifies a
+  // recordset by Name+Type+SetIdentifier, not by any Pulse-internal id, so a
+  // mismatch here would UPSERT a brand-new AWS recordset (leaving the one
+  // `recordId` actually denotes untouched) while corrupting the mirror's
+  // record_key = zoneId:name:type:setIdentifier invariant. The UI disables
+  // these fields in edit mode, but per T-24-02 the server never relies on
+  // the UI hiding a control — reject any attempt to rename/retype instead of
+  // silently targeting a different record set.
+  const existingSetIdentifier = existing.setIdentifier ?? null;
+  if (name !== existing.name || type !== existing.type || setIdentifier !== existingSetIdentifier) {
+    return NextResponse.json(
+      {
+        error: 'Cannot change name/type/setIdentifier via update',
+        message: 'Renaming or retyping a record is a delete-plus-create, not an update.',
+      },
+      { status: 400 }
+    );
+  }
+
   const beforeValue = {
     name: existing.name,
     type: existing.type,