outrank Arco button variants and drop the credential hint

The neon tube rules never applied. Arco emits .arco-btn-primary along
with three attribute variants ([type='button'], [type='submit'],
[type='reset']) that lift specificity to (0,2,0), and their :hover forms
reach (0,3,0) — all of which beat a bare .arco-btn-primary. Every rule
now uses .arco-btn.arco-btn-X[type='...'] so the skin wins regardless of
the rendered html-type; login is a submit button, which is why it stayed
solid.

Verified with jsdom computed styles against the real arco.css.

Also remove the default-credential chips from the login page: printing
admin / 123456 on a sign-in screen leaks the credentials of a reachable
deployment. The one-click fill shortcut stays. The test that asserted
the hint is now shown is inverted to assert it is absent.

packages/client/src/i18n/locales/zh.ts

@@ -12,7 +12,6 @@ export default {
     tokenLogin: '令牌登录',
     usernamePlaceholder: '用户名',
     passwordPlaceholder: '密码',
-    defaultCredentialsHint: '默认登录名：admin，默认密码：123456',
     credentialsRequired: '请输入用户名和密码',
     invalidCredentials: '用户名或密码错误',
     tooManyAttempts: '登录失败次数过多，请稍后重试',
@@ -24,7 +23,7 @@ export default {
     offline: '无法连接到服务器 · 登录仍可尝试',
     showPassword: '显示密码',
     hidePassword: '隐藏密码',
-    fillDefaultCredentials: '填入 admin / 123456',
+    fillDefaults: '使用默认账号登录',
     localDeploymentNote: '本地部署 · 无遥测 · 数据不出机器',
     tokenHint: '登录后 POST /api/auth/login 返回的 token 存入 localStorage',
     accessDenied: '你没有权限访问该资源',