DORA Third-Party AI Risk: A Practical Checklist for Financial Firms