## Why

Server deletion currently trusts role and ownership alone, which is too loose for a destructive action. The UI also lets users trigger deletion without re-entering their password, so a stolen session or stray click can remove a server too easily.

## What Changes

- Require server delete to be explicitly confirmed with the current user password.
- Allow deletion only for the server creator/owner or a platform administrator.
- Keep the existing archive/delete flow, but expose the destructive action from the server list runtime actions with an intentional password confirmation.
- Return a clear authorization or password error when the confirmation fails.

## Capabilities

### New Capabilities
- `server-deletion`: deletion authorization and password confirmation for server instances.

### Modified Capabilities

## Impact

- `platform/` delete handler, service authorization, and password verification logic.
- `platform_web/` server list runtime-action delete confirmation dialog and API client request payload.
- Automated tests covering authorization, password failure, and successful deletion.