The CLI is the last piece of our own code still calling the old v3 DNS-check endpoint. The web app already moved to the newer v4 one, so this moves the improvmx domain check command over too.

Only this one command moves — every other CLI command stays on v3, because they call different endpoints that aren't being retired.

Merge order: 2 of 2 — merge #2 first. #2 fixes this same command's display bug on v3. This PR redoes that same reading-code fix and switches to v4, so the two diffs overlap on cmd/domain.go. Once #2 is merged, that overlap drops out and only the v4 switch is left here.

Two things worth knowing:

• GET → POST is not a behavior change. Both endpoints run the exact same server code, so this call was never a pure read — it can mark a domain active and email its notification address, just like clicking "Check DNS" in the dashboard. That was already true on v3; POST just matches what the call actually does.
• --json loses one key: the top-level success: true. Everything inside records (DKIM, DMARC, DNS-provider details) is unchanged, since both endpoints build it from the same server code. That output isn't documented anywhere and the CLI is still v0.1.0.

Changes

• cmd/domain.go — domain check now calls the v4 verify endpoint and reads the result from inside records.
• internal/api/client.go — added a v4 base URL alongside the v3 one and a PostV4 helper, so this one command can use v4 while the rest of the CLI stays on v3. The request builder now takes a full URL instead of a path.
• internal/api/client.go — on a failed request, also read the v4 message field (v3 puts the error in error, v4 in message). Without it the new call printed the raw JSON instead of the sentence inside it — API error (404): {"errors":{},"message":"Not found."} now reads API error (404): Not found. While editing that block I also dropped two fields it parsed but never used.

Caveats

• This removes the CLI as a caller of v3 /check, but the route stays live. It's a public, documented endpoint, so actually retiring it is a separate api-side decision — gated on confirming external customers no longer call it — not a follow-up to this PR.

Testing

Ran the built CLI against production with a real API key.

• A configured domain (relai.co.za) reports OK; an unconfigured one reports MISSING.
• Confirmed it's genuinely on v4, not silently falling back to v3. The CLI POSTs to /verify, and only v4 answers that: POST /v3/…/verify → 404, POST /v4/…/verify → 200 with the records. The original GET /v3/…/check still returns 200 too — it's untouched and stays live.
• The error-message change is real too: on a 404, v3 returns {"error": "Not found.", "success": false} and v4 returns {"errors": {}, "message": "Not found."} — which is why the client now reads message and drops the two unused fields.
• CLI --json output matches hitting the endpoint directly.
• Checked failure messages for a wrong domain (404) and a bad API key (401), on both endpoints.
• Re-ran domain list, domain get, alias list, account and smtp list — the v3 commands still work.

No automated tests — this repo has none.