fix: 删除操作清理远端资源并拦截悬空引用

- 部署删除: k8s 模式清理 StatefulSet/Service/ConfigMap 与 PVC，先卸载关联采集器
- 采集器删除: 同步卸载成功后再删记录，失败保留避免孤儿
- 集群/存储/主机删除: 有部署或采集器引用时拒绝，避免悬空外键
- Token RBAC 补 services/proxy，保证 cluster-svc 数据源可查询

backend/services/collector.go

@@ -488,30 +488,59 @@ func (s *CollectorService) Update(id uint, updates map[string]interface{}) error
 	return utils.ErrNotFound
 }
 
+// UninstallCollectorsForDeployment 卸载并删除某部署下的所有采集器。
+// 卸载失败时保留记录，避免远端资源失去跟踪。
+func UninstallCollectorsForDeployment(ctx context.Context, deploymentID uint) {
+	db := repository.GetDB()
+	db.RLock()
+	var targets []models.Collector
+	for _, c := range db.Collectors {
+		if c.LokiDeploymentID == deploymentID {
+			targets = append(targets, c)
+		}
+	}
+	db.RUnlock()
+
+	for i := range targets {
+		c := targets[i]
+		if err := NewCollectorDeployer(&c, c.LokiDeployment, nil).Uninstall(ctx); err != nil {
+			log.Printf("[deploy-delete] 采集器 %q 卸载失败，保留记录: %v", c.Name, err)
+			continue
+		}
+		db.Lock()
+		for j := range db.Collectors {
+			if db.Collectors[j].ID == c.ID {
+				db.Collectors = append(db.Collectors[:j], db.Collectors[j+1:]...)
+				break
+			}
+		}
+		db.RequestSave()
+		db.Unlock()
+	}
+}
+
 func (s *CollectorService) Delete(id uint) error {
 	collector, err := s.Get(id)
 	if err != nil {
 		return utils.ErrNotFound
 	}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	// 先卸载远端资源，成功后再删记录；卸载失败直接返回，避免「界面删了、远端还在」
+	if err := NewCollectorDeployer(collector, collector.LokiDeployment, nil).Uninstall(ctx); err != nil {
+		return fmt.Errorf("卸载采集器失败，未删除记录: %w", err)
+	}
 	db := repository.GetDB()
 	db.Lock()
+	defer db.Unlock()
 	for i, c := range db.Collectors {
 		if c.ID == id {
 			db.Collectors = append(db.Collectors[:i], db.Collectors[i+1:]...)
-			break
+			db.RequestSave()
+			return nil
 		}
 	}
-	db.Unlock()
-	db.RequestSave()
-	// 异步卸载（用拷贝的 collector，避免删除后取不到；失败留日志，远端不留孤儿容器也无提示）
-	go func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-		defer cancel()
-		if err := NewCollectorDeployer(collector, collector.LokiDeployment, nil).Uninstall(ctx); err != nil {
-			log.Printf("[collector] 删除后卸载 %q(目标 %s)失败: %v", collector.Name, collector.Name, err)
-		}
-	}()
-	return nil
+	return utils.ErrNotFound
 }
 
 // Install 异步部署采集器