Theme: add hover/focus/disabled/loading state regression coverage (#91 follow-up) #114

#91's own acceptance criteria calls for "Visual/DOM regression coverage includes default, hover, focus, disabled, loading, validation, error, and success states." Checked while closing out #91's remaining sub-items (account console theme, email theme): login.spec.ts and account.spec.ts both cover default/validation/error/success states thoroughly (screenshots + explicit computed-style/DOM assertions), and focus is exercised incidentally by keyboard-interaction tests (#103's staged identity/credential flow), but there is no explicit, intentional coverage of:

• hover states on primary/secondary buttons and links
• disabled states (submit-in-flight login.disabled = true, disabled form controls)
• loading/busy states (xore-auth.js's WebAuthn busy-state visual, form submission pending state)

None of this is a known theme bug -- it's an acceptance-criterion gap in test coverage, found while doing a final pass before closing #91, not scope-crept into that close-out. Proposed: add page.hover()/forced-state (:hover/:focus-visible via page.locator(...).evaluate class injection or real interaction) screenshot + computed-style assertions to login.spec.ts for the primary/secondary button treatments already documented in login.css's own comments (the ::after-pseudo-element custom-property indirection), plus a real slow-network-simulated or artificially-delayed submit to exercise the disabled/loading state.