fix: correct provider lookup in deleteServer

Bug: deleteServer was using pricing.provider_name (always "Anvil")
instead of pricing.source_provider (linode/vultr).

Changes:
- provisioning-service.ts: Use source_provider for provider lookup
- provision.ts: Add user validation and better error handling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/handlers/provision.ts

@@ -280,10 +280,18 @@ export async function handleDeleteOrder(
       env.VULTR_API_KEY
     );
 
+    // Verify user exists first (same pattern as handleGetOrder)
+    const balance = await provisioningService.getUserBalance(userId);
+    if (!balance) {
+      return createErrorResponse('User not found', 404, 'NOT_FOUND', corsHeaders);
+    }
+
     const result = await provisioningService.deleteServer(orderId, userId);
 
     if (!result.success) {
-      return createErrorResponse(result.error!, 400, 'DELETE_FAILED', corsHeaders);
+      // Map specific errors to appropriate status codes
+      const statusCode = getDeleteErrorStatusCode(result.error!);
+      return createErrorResponse(result.error!, statusCode, 'DELETE_FAILED', corsHeaders);
     }
 
     return createSuccessResponse({ message: 'Server terminated successfully' }, 200, corsHeaders);
@@ -293,6 +301,16 @@ export async function handleDeleteOrder(
   }
 }
 
+/**
+ * Map delete error messages to HTTP status codes
+ */
+function getDeleteErrorStatusCode(error: string): number {
+  if (error === 'Order not found') return 404;
+  if (error === 'Unauthorized') return 403;
+  if (error === 'User not found') return 404;
+  return 400; // Default for validation/business logic errors
+}
+
 /**
  * GET /api/provision/balance
  * Get user's balance (in KRW)