Refactor domain-match lookup to idiomatic Load + filter

Replace the cross-entity JOIN in
DetectedTrackers.LoadCommonThirdPartyIDByDomainMatch with two
idiomatic coredata calls: LoadInitiatorDomainsByTrackerPatternID
on DetectedTrackers, then a new CommonThirdPartyDomains.Load with
a CommonThirdPartyDomainFilter. Each entity now queries only its
own table, and the caller orchestrates the lookup.

Document the Load vs LoadAll naming convention and the no
cross-entity JOINs rule in contrib/claude/coredata.md.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/coredata/common_third_party_domain.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"maps"
 	"time"
 
 	"github.com/jackc/pgx/v5"
@@ -189,6 +190,47 @@ func (d CommonThirdPartyDomain) Delete(
 	return nil
 }
 
+func (ds *CommonThirdPartyDomains) Load(
+	ctx context.Context,
+	conn pg.Querier,
+	limit int,
+	filter *CommonThirdPartyDomainFilter,
+) error {
+	q := `
+SELECT
+    id,
+    common_third_party_id,
+    domain,
+    created_at,
+    updated_at
+FROM
+    common_third_party_domains
+WHERE
+    %s
+ORDER BY domain ASC
+LIMIT @limit;
+`
+
+	q = fmt.Sprintf(q, filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"limit": limit}
+	maps.Copy(args, filter.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query common third party domains: %w", err)
+	}
+
+	domains, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CommonThirdPartyDomain])
+	if err != nil {
+		return fmt.Errorf("cannot collect common third party domains: %w", err)
+	}
+
+	*ds = domains
+
+	return nil
+}
+
 func (ds *CommonThirdPartyDomains) LoadByCommonThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,