I kept at it, and got it to work without any static configuration (but still have to use NAT)

I still need the NAT rule, and what’s strange is that the workstation gets IP address from /56 prefix (which is configured as the WAN prefix on the modem):

my pfSense receives this IP via DHCPV6:

IA_NA address: 2605:e000:855b:de00::xxxxxxxx pltime=3600 vltime=3600
update a prefix 2605:e000:855b:def0::/60 pltime=3600, vltime=3600

The prefix pfSense gets is OUTSIDE of the DHCPv6 range configured on the LAN side of the modem (2605:e000:855b:de00::/64)