account.spec.ts narrow-viewport coverage + a11y fix (#113), login.spec.ts hover/focus/disabled/loading coverage (#114)

[Xore]

Summary — #113

• account.spec.ts previously skipped every project but desktop-1440 outright: below ~820px the sidebar nav collapses behind a hamburger toggle these tests never drove, so nav text was present in the DOM but hidden off-canvas -- a 30s timeout per test that blew CI's 15-minute regression-job budget once this file entered the project matrix.
• Added openSidebarNav()/closeSidebarNavIfOpen() and wired them into every describe block that navigates via the sidebar. "Personal info"'s own screenshot tests stay desktop-1440-only -- they already manage their own explicit viewport contexts (a real redundancy concern, not the hamburger gap), the WCAG check does not (it needs to run at every width, since that's where the real bug lives).
• Un-skipping the suite surfaced two further narrow-only collapse patterns, both now handled: the masthead's user-menu options move into its own kebab below lg, and each credential row's own action (e.g. "Set up Authenticator application") moves into a per-row kebab the same way.
• Fixed the actual bug account.spec.ts: narrow-viewport (tablet-820/mobile-390/iphone-393) runs fail; account console has a real button-name a11y gap at mobile-390/iphone-393 #113 was filed for: a critical WCAG button-name violation at mobile-390/iphone-393 on an icon-only "more actions" kebab (pf-v5-c-menu-toggle.pf-m-plain) with no aria-label, no text, no aria-labelledby. This is compiled upstream PatternFly/React markup, so it's patched post-render via a new xore-account.js (theme.properties' scripts=, mirroring the login theme's own xore-auth.js) that labels every instance of the pattern via a MutationObserver -- found live that the same unlabeled-kebab pattern also exists per-credential-row, not just at the masthead, so it targets the class rather than one specific data-testid.
• Also fixed a real bug in the screenshot baselines themselves: selecting a nav item doesn't auto-close the drawer here, so a screenshot taken right after navigating (without an explicit close) captured the open drawer sitting on top of the actual page content it was meant to verify.

Summary — #114

#91's own acceptance criteria calls for "hover, focus, disabled, loading" state coverage; none of the four had explicit, intentional coverage before this.

• Primary/secondary button hover + keyboard-focus: computed-style assertions via toHaveCSS (not a bare evaluate() read, which raced login.css's own background-color transition and flaked).
• Disabled: a real network-delayed submit (page.route holding the login-actions/authenticate POST) to catch the button disabled mid-flight -- Playwright's own locator actions wait for in-flight navigation to settle before running at all, so both the click and the disabled-read happen inside one page.evaluate() to avoid deadlocking against the held request.
• Loading/busy: extended the existing stateful WebAuthn registration ceremony test with a check that aria-busy/.kc-busy (xore-auth.js's own click listener) apply synchronously the instant the ceremony starts, read the same single-evaluate() way so it can't race the ceremony itself resolving.

Test plan

• account.spec.ts run across all 6 projects: only the 2 pre-existing font-rendering screenshot diffs remain (present before any of these changes, unrelated to them) -- everything else passes, including every newly-unskipped test.
• login.spec.ts run across all 6 projects: only pre-existing font-rendering/timestamp screenshot noise remains -- every #114 test and the modified WebAuthn test pass cleanly on every project.
• New narrow/wide-viewport baseline screenshots reviewed by eye (kebab menus open correctly, drawer closed before the shot, real content visible).