Fix workflow start, delete guard, package buttons, export, settings CSS

- Add StartBySlug handler + /api/v1/workflow-entry/:scope/:slug route
  so landing page Start button resolves scope/slug and creates instance
- Guard admin DELETE /api/v1/workflows/:id to reject team-scoped
  workflows (must use team endpoint) preventing accidental global delete
- Hide Delete button for bundled packages (match Export/Update guards)
- Package export uses fetch() with auth + toast on missing assets
- Settings form padding-bottom increased to --sp-12 for save button
- Admin workflow editor: shared StageForm component, public entry URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -444,6 +444,10 @@ func main() {
 			publicWf.POST("/advance/:token", publicWfH.AdvancePublic)
 		}
 
+		// Landing-page entry: POST /api/v1/workflow-entry/:scope/:slug
+		// Resolves scope+slug → workflow ID, starts instance, returns redirect.
+		api.POST("/workflow-entry/:scope/:slug", authLimiter.Limit(), publicWfH.StartBySlug)
+
 		// ── Workflow Scanner ──────────
 		wfScanner := workflow.NewScanner(stores, bus)
 		wfScanner.Start()