Block server destruction while linked to an active beta

Protect individual, bulk, and queued removals and rebuilds until beta closure. Recheck ownership before teardown and reject beta admission during pending or unresolved destruction.

Fixes #36

src/lib/server/fleet/beta.ts

@@ -357,6 +357,14 @@ export async function openBeta(input: OpenBetaInput): Promise<OpenBetaResult> {
     for (const name of input.servers) {
         const row = getServer(name);
         if (!row) throw new BetaError(`unknown server: ${name}`, 'unknown-server');
+        // Once teardown is queued or in flight, opening a beta cannot safely
+        // claim the instance. A failed remote request may still be running.
+        const removal = db().prepare(`SELECT id FROM server_deployments WHERE server = ? AND server_deleted_at IS NULL
+            AND action IN ('destroy', 'rebuild') AND (state IN ('waiting', 'queued', 'running', 'awaiting-health')
+                OR (state IN ('failed', 'interrupted') AND stage IN (
+                    'Stopping and removing container', 'Deleting Komodo deployment', 'Removing server files and registry')))
+            LIMIT 1`).get(name);
+        if (removal) throw new BetaError(`${name}: cancel or finish the pending destruction or rebuild before opening a beta.`, 'conflict');
         serverRows.push({ name, game: row.game, map: row.map });
     }