Fix workflow start, delete guard, package buttons, export, settings CSS

- Add StartBySlug handler + /api/v1/workflow-entry/:scope/:slug route
  so landing page Start button resolves scope/slug and creates instance
- Guard admin DELETE /api/v1/workflows/:id to reject team-scoped
  workflows (must use team endpoint) preventing accidental global delete
- Hide Delete button for bundled packages (match Export/Update guards)
- Package export uses fetch() with auth + toast on missing assets
- Settings form padding-bottom increased to --sp-12 for save button
- Admin workflow editor: shared StageForm component, public entry URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/workflow_public_handlers.go

@@ -36,6 +36,51 @@ type publicInstanceResponse struct {
 	UpdatedAt       any             `json:"updated_at"`
 }
 
+// StartBySlug resolves a scope+slug to a workflow and starts a public instance.
+// POST /api/v1/workflow-entry/:scope/:slug
+// Called by the workflow landing page (/w/:scope/:slug).
+func (h *WorkflowPublicHandler) StartBySlug(c *gin.Context) {
+	scope := c.Param("scope")
+	slug := c.Param("slug")
+
+	var teamID *string
+	if scope != "global" {
+		teamID = &scope
+	}
+
+	wf, err := h.stores.Workflows.GetBySlug(c.Request.Context(), teamID, slug)
+	if err != nil || wf == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "workflow not found"})
+		return
+	}
+
+	var body struct {
+		Data json.RawMessage `json:"data"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil && err.Error() != "EOF" {
+		body.Data = json.RawMessage(`{}`)
+	}
+	if len(body.Data) == 0 {
+		body.Data = json.RawMessage(`{}`)
+	}
+
+	inst, err := h.engine.StartPublic(c.Request.Context(), wf.ID, body.Data)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Return redirect for the landing page JS
+	redirectTo := "/w/" + inst.ID
+	if inst.EntryToken != nil {
+		redirectTo = "/w/" + inst.ID + "?token=" + *inst.EntryToken
+	}
+	c.JSON(http.StatusCreated, gin.H{
+		"id":          inst.ID,
+		"redirect_to": redirectTo,
+	})
+}
+
 // StartPublic creates an anonymous workflow instance.
 // POST /api/v1/public/workflows/:id/start
 func (h *WorkflowPublicHandler) StartPublic(c *gin.Context) {