fix(hetzner): use availability API for real-time capacity data

Switch back to /api/deployments/availability/* endpoints which check
Hetzner's datacenter API for ACTUAL capacity:

- /api/deployments/availability/locations - Returns locations with
  server types that are CURRENTLY available (not just exist)
- /api/deployments/availability/server-types - Returns server types
  sorted by price, filtered to those actually in stock

The previous /api/v1/cloud-runner/hetzner/options endpoint returned
ALL locations and server types without checking real-time capacity,
leading to incorrect recommendations (e.g., showing cx23 as cheapest
when it's actually out of stock).

Also expanded credential error detection patterns to catch:
- 401 status codes
- 412 (failedPrecondition) status codes
- Various "token" related messages

Co-Authored-By: Claude <noreply@anthropic.com>

Author: 2 people

src/wizard/cloud_provider_data.rs

@@ -193,38 +193,32 @@ fn server_type_to_dynamic(st: &ServerTypeSummary) -> DynamicMachineType {
     }
 }
 
-/// Fetch Hetzner regions dynamically with real-time availability
+/// Fetch Hetzner regions dynamically with REAL-TIME availability
 ///
-/// Uses the /api/v1/cloud-runner/hetzner/options endpoint (same as frontend).
-/// Returns regions with availability info directly from Hetzner API.
-/// The agent uses this to make smart deployment decisions based on actual capacity.
+/// Uses the /api/deployments/availability/locations endpoint which checks
+/// Hetzner's datacenter API for actual capacity - not just what exists.
+/// Returns only regions where server types are CURRENTLY available.
 ///
 /// # Errors
 /// Returns error if credentials are missing or API call fails.
 pub async fn get_hetzner_regions_dynamic(
     client: &PlatformApiClient,
     project_id: &str,
 ) -> HetznerFetchResult<Vec<DynamicCloudRegion>> {
-    match client.get_hetzner_options(project_id).await {
-        Ok(options) => {
-            let regions: Vec<DynamicCloudRegion> = options.locations.iter().map(|loc| {
-                DynamicCloudRegion {
-                    id: loc.name.clone(),
-                    name: loc.city.clone(),
-                    location: loc.country.clone(),
-                    network_zone: loc.network_zone.clone(),
-                    // Find server types available at this location
-                    available_server_types: options.server_types.iter()
-                        .filter(|st| st.available_locations.contains(&loc.name))
-                        .map(|st| st.name.clone())
-                        .collect(),
-                }
-            }).collect();
-            HetznerFetchResult::Success(regions)
+    match client.get_hetzner_locations(project_id).await {
+        Ok(locations) => {
+            HetznerFetchResult::Success(locations.iter().map(location_to_dynamic_region).collect())
         }
         Err(e) => {
             let error_msg = e.to_string();
-            if error_msg.contains("credentials") || error_msg.contains("Unauthorized") || error_msg.contains("token") {
+            // Check for various credential-related error patterns
+            if error_msg.contains("credentials")
+                || error_msg.contains("Unauthorized")
+                || error_msg.contains("token")
+                || error_msg.contains("API token")
+                || error_msg.contains("401")
+                || error_msg.contains("412") // failedPrecondition
+            {
                 HetznerFetchResult::NoCredentials
             } else {
                 HetznerFetchResult::ApiError(error_msg)
@@ -233,42 +227,33 @@ pub async fn get_hetzner_regions_dynamic(
     }
 }
 
-/// Fetch Hetzner server types dynamically with pricing and availability
+/// Fetch Hetzner server types dynamically with REAL-TIME availability and pricing
 ///
-/// Uses the /api/v1/cloud-runner/hetzner/options endpoint (same as frontend).
-/// Returns server types sorted by monthly price (cheapest first) with
-/// real-time availability per region. The agent uses this for cost-optimized
-/// resource selection.
+/// Uses the /api/deployments/availability/server-types endpoint which returns
+/// server types sorted by price with ACTUAL availability per datacenter.
+/// Only returns server types that are currently in stock.
 ///
 /// # Errors
 /// Returns error if credentials are missing or API call fails.
 pub async fn get_hetzner_server_types_dynamic(
     client: &PlatformApiClient,
     project_id: &str,
-    _preferred_location: Option<&str>,
+    preferred_location: Option<&str>,
 ) -> HetznerFetchResult<Vec<DynamicMachineType>> {
-    match client.get_hetzner_options(project_id).await {
-        Ok(options) => {
-            let mut server_types: Vec<DynamicMachineType> = options.server_types.iter()
-                .filter(|st| !st.deprecated)
-                .map(|st| DynamicMachineType {
-                    id: st.name.clone(),
-                    name: st.name.clone(),
-                    cores: st.cores,
-                    memory_gb: st.memory,
-                    disk_gb: st.disk,
-                    price_monthly: st.price_monthly,
-                    price_hourly: st.price_monthly / 730.0, // Approximate hourly from monthly
-                    available_in: st.available_locations.clone(),
-                })
-                .collect();
-            // Sort by price (cheapest first)
-            server_types.sort_by(|a, b| a.price_monthly.partial_cmp(&b.price_monthly).unwrap());
-            HetznerFetchResult::Success(server_types)
+    match client.get_hetzner_server_types(project_id, preferred_location).await {
+        Ok(server_types) => {
+            HetznerFetchResult::Success(server_types.iter().map(server_type_to_dynamic).collect())
         }
         Err(e) => {
             let error_msg = e.to_string();
-            if error_msg.contains("credentials") || error_msg.contains("Unauthorized") || error_msg.contains("token") {
+            // Check for various credential-related error patterns
+            if error_msg.contains("credentials")
+                || error_msg.contains("Unauthorized")
+                || error_msg.contains("token")
+                || error_msg.contains("API token")
+                || error_msg.contains("401")
+                || error_msg.contains("412") // failedPrecondition
+            {
                 HetznerFetchResult::NoCredentials
             } else {
                 HetznerFetchResult::ApiError(error_msg)