Fix workflow entry token resolution and fieldset submit guard

RenderWorkflow() was passing the route param (instance ID) as the
entry token to the template JS. The advance API needs the actual
entry token from the instance. Now resolves from inst.EntryToken
and checks the ?token= query param from the landing page redirect.

Also fix submitForm() early-return guard that blocked progressive
forms using fieldsets (checked FORM_TPL.fields but not .fieldsets).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/templates/workflow.html

@@ -398,7 +398,7 @@
     }
 
     window.submitForm = async function() {
-        if (!FORM_TPL || !FORM_TPL.fields) return;
+        if (!FORM_TPL || (!FORM_TPL.fields && !FORM_TPL.fieldsets)) return;
         var btn = document.getElementById('formSubmitBtn');
         if (btn) btn.disabled = true;