fix: 删除操作清理远端资源并拦截悬空引用

- 部署删除: k8s 模式清理 StatefulSet/Service/ConfigMap 与 PVC，先卸载关联采集器
- 采集器删除: 同步卸载成功后再删记录，失败保留避免孤儿
- 集群/存储/主机删除: 有部署或采集器引用时拒绝，避免悬空外键
- Token RBAC 补 services/proxy，保证 cluster-svc 数据源可查询

backend/services/deployment.go

@@ -3,6 +3,7 @@ package services
 import (
 	"context"
 	"fmt"
+	"log"
 	"net"
 	"regexp"
 	"strconv"
@@ -315,18 +316,39 @@ func (s *DeploymentService) Delete(id uint) error {
 	if err != nil {
 		return err
 	}
-	if deployment.Mode == "host-docker" {
-		if deployment.Status == "deploying" {
-			return fmt.Errorf("部署正在进行中，请等待完成后删除")
-		}
+	if deployment.Status == "deploying" {
+		return fmt.Errorf("部署正在进行中，请等待完成后删除")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	// 先卸载该部署下的采集器：它们依赖这个 Loki 实例，留着会指向不存在的服务
+	UninstallCollectorsForDeployment(ctx, id)
+
+	switch deployment.Mode {
+	case "host-docker":
 		if deployment.Status != "pending" {
-			ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
-			defer cancel()
 			if err := deleteDockerLoki(ctx, deployment); err != nil {
 				return err
 			}
 		}
+	case "k8s-yaml":
+		// 停止/重启走 CleanupLoki 时保留 PVC；这里是显式删除，连数据卷一起清理
+		CleanupLoki(ctx, deployment)
+		if deployment.Cluster != nil {
+			ns := deployment.Namespace
+			if ns == "" {
+				ns = "log"
+			}
+			if err := deleteK8sResource(ctx, deployment.Cluster, "persistentvolumeclaim", ns, "loki-data"); err != nil {
+				log.Printf("[deploy-delete] 清理 PVC %s/loki-data 失败: %v", ns, err)
+			}
+		}
+	case "host-binary":
+		CleanupLoki(ctx, deployment)
 	}
+
 	db := repository.GetDB()
 	db.Lock()
 	removedName := ""