browser/openspec/changes/restrict-server-delete-with-password-confirmation/tasks.md

1. Backend delete confirmation

• 1.1 Add a server delete request DTO and extend the service/API contract to accept the current session password on delete.
• 1.2 Verify the current session password in the server deletion flow after owner/admin authorization and keep the existing deleted-state behavior.
• 1.3 Update API handler docs and backend tests for owner/admin success, password failure, and unsafe-state rejection.

2. Frontend delete flow

• 2.1 Update the server detail delete confirmation dialog to collect a password and submit it with the delete request.
• 2.2 Rename the user-facing action copy from archive to delete where the destructive action is exposed.
• 2.3 Update the API client, contracts, and frontend tests for the new delete payload and confirmation state.

3. Verification

• 3.1 Run the structure check and focused backend/frontend tests for the delete flow.

4. Follow-up UI placement

• 4.1 Move the delete confirmation entry from server detail metadata to the server list runtime action popover.
• 4.2 Update frontend tests and verification for the new delete entry placement.