Fix workflow start, delete guard, package buttons, export, settings CSS

- Add StartBySlug handler + /api/v1/workflow-entry/:scope/:slug route
  so landing page Start button resolves scope/slug and creates instance
- Guard admin DELETE /api/v1/workflows/:id to reject team-scoped
  workflows (must use team endpoint) preventing accidental global delete
- Hide Delete button for bundled packages (match Export/Update guards)
- Package export uses fetch() with auth + toast on missing assets
- Settings form padding-bottom increased to --sp-12 for save button
- Admin workflow editor: shared StageForm component, public entry URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/workflows.go

@@ -149,8 +149,24 @@ func (h *WorkflowHandler) Update(c *gin.Context) {
 
 // Delete deletes a workflow and all its stages/versions (CASCADE).
 // DELETE /api/v1/workflows/:id
+// Admin-only: only allows deleting global (team_id IS NULL) workflows.
+// Team-scoped workflows must be deleted via the team endpoint.
 func (h *WorkflowHandler) Delete(c *gin.Context) {
-	if err := h.stores.Workflows.Delete(c.Request.Context(), c.Param("id")); err != nil {
+	ctx := c.Request.Context()
+	wfID := c.Param("id")
+
+	// Guard: prevent accidental deletion of team-scoped workflows from the admin endpoint
+	wf, err := h.stores.Workflows.GetByID(ctx, wfID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "workflow not found"})
+		return
+	}
+	if wf.TeamID != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": "team-scoped workflows must be deleted via the team endpoint"})
+		return
+	}
+
+	if err := h.stores.Workflows.Delete(ctx, wfID); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to delete workflow"})
 		return
 	}