Block server destruction while linked to an active beta

Protect individual, bulk, and queued removals and rebuilds until beta closure. Recheck ownership before teardown and reject beta admission during pending or unresolved destruction.

Fixes #36

src/lib/server/fleet/servers.ts

@@ -153,6 +153,15 @@ export function listServers(): ServerRow[] {
     return db().prepare('SELECT * FROM servers WHERE destroyed_at IS NULL ORDER BY name').all() as ServerRow[];
 }
 
+/** Beta ownership lasts until explicit closure, regardless of test outcome or stage. */
+export function activeBetaRemovalBlocker(server: string): string | null {
+    const betas = db().prepare(`SELECT b.id FROM beta_servers bs JOIN betas b ON b.id = bs.beta_id
+        WHERE bs.server = ? AND bs.server_deleted_at IS NULL AND b.state IN ('running', 'ready-promote')
+        ORDER BY b.id`).all(server) as { id: number }[];
+    if (!betas.length) return null;
+    return `${server} is linked to active beta${betas.length === 1 ? '' : 's'} ${betas.map(beta => '#' + beta.id).join(', ')}. Promote or roll back the beta${betas.length === 1 ? '' : 's'} before destroying or rebuilding this server.`;
+}
+
 export function setServerField(
     name: string,
     field: keyof ServerRow,