## ADDED Requirements

### Requirement: Authorized server deletion
The system SHALL allow a server instance to be deleted only when the authenticated user is the instance owner or a platform administrator.

#### Scenario: Owner deletes a server
- **WHEN** the instance owner submits a delete request for their server
- **THEN** the system SHALL accept the request if all other delete checks pass

#### Scenario: Non-owner cannot delete
- **WHEN** an authenticated user who is neither the owner nor a platform administrator submits a delete request
- **THEN** the system SHALL reject the request with forbidden access

### Requirement: Password confirmation for deletion
The system SHALL require the authenticated user to provide their current account password with every server delete request and SHALL reject the request if the password is missing or does not match the current session user.

#### Scenario: Password mismatch
- **WHEN** the authenticated user submits the delete request with an incorrect password
- **THEN** the system SHALL reject the request with forbidden access

#### Scenario: Password required
- **WHEN** the authenticated user submits the delete request without a password
- **THEN** the system SHALL reject the request as invalid input or forbidden access

### Requirement: Safe server removal state
The system SHALL continue to reject deletion when the server instance is running or installing, and SHALL otherwise mark the server instance as deleted while preserving historical records.

#### Scenario: Running server cannot be deleted
- **WHEN** a delete request targets a running server instance
- **THEN** the system SHALL reject the request and keep the server instance intact

#### Scenario: Successful deletion marks deleted state
- **WHEN** a valid delete request targets a stopped or ready server instance
- **THEN** the system SHALL mark the server instance as deleted and return the updated instance