Provider credential deletion still sends credential_id in DELETE body

### Self Checks

- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] I have searched for existing issues and pull requests, including closed ones.
- [x] I confirm that I am using English to submit this report.

### Dify version

main

### Cloud or Self Hosted

Both

### Problem

The Web provider-credential delete hook still sends `credential_id` in a DELETE request body:

```ts
del(`/workspaces/current/model-providers/${provider}/credentials`, {
body: { credential_id },
})
```

This leaves the browser path vulnerable to intermediaries that drop DELETE request bodies. Adjacent model/custom-model credential DELETE paths were moved to query parameters in #42162 for the same transport reason.

### Runtime contract

Dify's shared `@model_validate` handling already reads DELETE query parameters first and falls back to a JSON body. The backend therefore already accepts:

```text
DELETE /console/api/workspaces/current/model-providers//credentials?credential_id=
```

without removing compatibility for older body-based callers.

### Expected behavior

`useDeleteProviderCredential()` should send `credential_id` through request query params rather than the DELETE body.

### Proposed bounded scope

- change the Web provider-credential delete hook from `body` to `params`;
- add a focused service-hook regression test that asserts the request shape;
- leave backend/service behavior unchanged.

The endpoint's OpenAPI annotation still describes the legacy DELETE body shape. That contract cleanup can be handled separately with generated-contract regeneration; it is not required for the browser runtime fix because DELETE query parsing is already supported upstream.

Implementation: #42208.

Start at the Web service hook named useDeleteProviderCredential() and compare its request shape with the adjacent model/custom-model credential DELETE paths moved in #42162. Change the request to use query parameters, add the focused service-hook regression test described in the issue, and confirm the test asserts the query-based request without changing backend behavior.

Written by the indexing model from the issue text.