完善活动任务删除保护

扩展域名删除时的活动任务状态保护，补充 retry_wait 与 cancelling 回归测试。

backend/internal/repository/project_domain_repository.go

@@ -113,7 +113,7 @@ func (r *SQLProjectMemberRepository) DeleteProjectDomain(ctx context.Context, ac
 	}
 	rows, err := tx.QueryContext(ctx, Rebind(r.driver, `SELECT id FROM tasks
 		WHERE domain_id = ? AND task_type IN ('certificate_issue', 'certificate_validate', 'certificate_deploy', 'certificate_import', 'certificate_restore')
-		AND status IN ('queued', 'running')`+r.resourceWriteLock()), domainID)
+		AND status IN ('queued', 'running', 'retry_wait', 'cancelling')`+r.resourceWriteLock()), domainID)
 	if err != nil {
 		return fmt.Errorf("检查域名任务失败：%w", err)
 	}

backend/internal/repository/project_domain_repository_test.go

@@ -71,6 +71,18 @@ func TestProjectDomainRepositorySQLite(t *testing.T) {
 		t.Fatal(err)
 	}
 	trigger := `CREATE TRIGGER reject_project_domain_audit BEFORE INSERT ON audit_logs BEGIN SELECT RAISE(ABORT, 'audit-failure'); END`
+	for _, status := range []string{"retry_wait", "cancelling"} {
+		taskID := "domain-active-task-" + status
+		if err := taskRepo.CreateTask(t.Context(), Task{HistoryScope: HistoryScope{ProjectID: item.ProjectID, ScopeType: ScopeProject}, ID: taskID, DomainID: item.ID, TaskType: "certificate_deploy", Status: status}); err != nil {
+			t.Fatal(err)
+		}
+		if err := writer.DeleteProjectDomain(t.Context(), "domain-manager", item.ID); !errors.Is(err, ErrProjectDomainBusy) {
+			t.Fatalf("任务状态 %s 下删除应拒绝：%v", status, err)
+		}
+		if _, err := db.DB.ExecContext(t.Context(), Rebind(cfg.Driver, "UPDATE tasks SET status = 'partial_success' WHERE id = ?"), taskID); err != nil {
+			t.Fatal(err)
+		}
+	}
 	if _, err := db.DB.ExecContext(t.Context(), trigger); err != nil {
 		t.Fatal(err)
 	}