CreateWorkflow binds the domain entity as its request DTO

`CreateWorkflowEndpoint` binds the persisted domain entity `WorkflowDefinition` directly as its request type (`WorkflowEndpoints.cs`: `Endpoint`), rather than a distinct write DTO the way the other write endpoints do (`SaveQueryRequest`, `TenantWriteRequest`, `SaveConnectorRequest`). Server-owned fields are only partially reasserted (`Id` is overwritten in the handler).

Not exploitable today: the endpoint is gated by `manage_workflows` and the impact is limited to fields on `WorkflowDefinition`. Filed as a design-consistency and mass-assignment-hygiene item, not a vulnerability.

Fix: introduce a dedicated write DTO so no internal or server-owned field can be set from the request body.

Start in WorkflowEndpoints.cs at the CreateWorkflowEndpoint declaration and compare its request binding with SaveQueryRequest, TenantWriteRequest, and SaveConnectorRequest. Introduce a dedicated write DTO for this endpoint so the request cannot set internal or server-owned WorkflowDefinition fields, and confirm the endpoint still accepts the intended workflow data.

Written by the indexing model from the issue text.