fix: workflow editor Phase 5/6 sign-off — save guard, conflict detection, dispatch pre-check

- Save button disabled for non-admins (canSave prop threaded through
  WorkflowEditor → WorkflowCanvas → WorkflowCanvasToolbar); tooltip
  explains why when hovered
- Optimistic concurrency: migration 072 adds updated_at to
  workflow_definitions; PUT /workflows/:id returns 409 when client sends
  a stale updated_at; frontend shows a specific reload-prompt toast
- _legacy_dispatch now routes through dispatch_order_line_render instead
  of calling render_order_line_task directly, so cancelled/rejected
  order lines are skipped before queueing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/workflows.ts

@@ -54,6 +54,7 @@ export interface WorkflowDefinition {
   rollout_summary: WorkflowRolloutSummary
   is_active: boolean
   created_at: string
+  updated_at: string
 }
 
 export interface WorkflowConfig {
@@ -239,7 +240,11 @@ export const getWorkflow = (id: string): Promise<WorkflowDefinition> =>
 export const createWorkflow = (data: WorkflowCreate): Promise<WorkflowDefinition> =>
   api.post('/workflows', data).then(r => normalizeWorkflowDefinition(r.data))
 
-export const updateWorkflow = (id: string, data: Partial<WorkflowCreate>): Promise<WorkflowDefinition> =>
+export interface WorkflowUpdatePayload extends Partial<WorkflowCreate> {
+  updated_at?: string
+}
+
+export const updateWorkflow = (id: string, data: WorkflowUpdatePayload): Promise<WorkflowDefinition> =>
   api.put(`/workflows/${id}`, data).then(r => normalizeWorkflowDefinition(r.data))
 
 export const deleteWorkflow = (id: string): Promise<void> =>