Add cancellation for collection launches

docs/guides/collections.md

@@ -2,7 +2,7 @@
 
 Open **Fleet → Collections** to manage reusable server lineups. Use
 **Active launches** to follow progress and **Launch history** to review completed
-launches and failures. Both views refresh automatically. A
+launches, cancellations, and failures. Both views refresh automatically. A
 collection describes a whole lineup: for example, two Kino lobbies, one Moon lobby,
 and two Town lobbies. Counts are desired fleet totals: existing and queued
 servers count toward each target, and only missing servers are created.
@@ -153,13 +153,37 @@ running. A confirmed creation failure is recorded for review, allowing later
 queued servers to proceed on subsequent passes without undoing successful launches.
 
 The collection launch page at `/collections/launches/:id` separates ready,
-launching, queued, and failed servers. Its breadcrumb returns to Collections. It
+launching, queued, failed, and cancelled servers. Its breadcrumb returns to Collections. It
 highlights the current startup, shows each waiting server's queue position, and
 links to earlier launches when another collection occupies the available capacity.
 Every server links to its Provisioning operation timeline and recovery options,
 and each child operation links back to its collection launch. Individual operations
 remain visible in Provisioning activity and history.
 
+### Cancel a collection launch
+
+Operators and administrators can choose **Cancel collection launch** on the
+collection progress page while eligible work remains. Review and confirm the
+cleanup before proceeding. Cancellation stops unfinished creations, including
+eligible failed or interrupted launches, and removes their containers and instance
+files. This can disconnect players who joined before startup verification finished,
+even when player status is unknown. Shared game files are kept. Keys and ports
+remain reserved until removal is confirmed.
+
+Completed launches, including those that finished with a warning, and retained
+servers are kept. In exact mode, safe pending removals belonging to this launch
+are cancelled. Removals that have already started or are still needed by another
+collection may finish; cancellation does not restore servers already removed.
+
+The progress page shows **Cancellation requested** while work or cleanup remains,
+then **Collection launch cancelled**, or **Cancellation needs attention** if
+operations or cleanup failed. Cancelled operations are counted separately
+from failures. Each cancelled creation links to its cleanup operation for progress
+and recovery. A launch stays in **Active launches** until its work and cleanup
+have settled; failed cleanup remains marked as needing attention in launch history.
+Cancellation does not delete the saved collection, so it can be previewed again
+against the remaining fleet.
+
 ## Create a single server
 
 1. Open **Create server** from the fleet or **Single server** from Provisioning.
@@ -296,11 +320,17 @@ there while preserving query parameters.
   A satisfied preview returns `{ ok: true, collectionId: null }` with HTTP 200,
   without creating a collection, saving keys, or kicking the worker.
 - `GET /api/deployment-collections`: list collection progress summaries with
-  separate `queued`, `provisioning`, and `verifying` counts.
+  separate `queued`, `provisioning`, `verifying`, and `cancelled` counts,
+  `cleanupActive` and `cleanupFailed` counts, and `cancelled_at` when cancellation
+  was requested. Cancelled operations are excluded from `failed`.
 - `GET /api/deployment-collections/:id`: collection mode, retained server IDs,
   per-operation progress with `action: create | destroy`,
   each waiting server's global `queuePosition`, and the shared queue's concurrency,
-  active startups, and queued count.
+  active startups, and queued count. Includes `canCancel` and each creation's
+  `cancellation` cleanup ID, state, stage, and error when applicable.
+- `POST /api/deployment-collections/:id/cancel`: request cancellation and cleanup
+  of eligible unfinished work. Returns `{ ok: true }`, HTTP 404 for an unknown
+  launch, or HTTP 409 when the launch cannot be cancelled.
 - `POST /api/deployments/preview`: preview `{ game, mapSlug }` or `{ deploymentId }`
   for a new single server using the latest promoted setup. All collections, including one-server
   targets, must use the collection endpoint so existing servers count correctly.