Clarify server delete API errors

platform_web/api/client.test.ts

@@ -810,6 +810,38 @@ describe("PlatformApiClient AI providers", () => {
     expect(onAuthFailure).not.toHaveBeenCalled();
   });
 
+  it("surfaces safe validation details for delete denials", async () => {
+    vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
+      code: "validation_failed",
+      message: "validation failed",
+      details: [
+        "running or installing server instances must be stopped before delete",
+        "config path /Users/operator/private/server.ini is unavailable"
+      ]
+    }), { status: 400, headers: { "Content-Type": "application/json" } })));
+
+    const client = new PlatformApiClient("/api/v1", () => "owner-session");
+    await expect(client.deleteServerInstance("running-server", { password: "secret-password" })).rejects.toMatchObject({
+      status: 400,
+      code: "validation_failed",
+      message: "运行中或安装中的服务器必须先停止再删除。；config path [host-path] is unavailable"
+    });
+  });
+
+  it("surfaces password confirmation denials without exposing generic forbidden text", async () => {
+    vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
+      code: "forbidden",
+      message: "password confirmation failed"
+    }), { status: 403, headers: { "Content-Type": "application/json" } })));
+
+    const client = new PlatformApiClient("/api/v1", () => "owner-session");
+    await expect(client.deleteServerInstance("server-1", { password: "wrong-password" })).rejects.toMatchObject({
+      status: 403,
+      code: "forbidden",
+      message: "当前登录密码不正确，请重新输入。"
+    });
+  });
+
   it("surfaces allow-listed plugin capability denials", async () => {
     vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
       code: "forbidden",