outrank Arco button variants and drop the credential hint

The neon tube rules never applied. Arco emits .arco-btn-primary along
with three attribute variants ([type='button'], [type='submit'],
[type='reset']) that lift specificity to (0,2,0), and their :hover forms
reach (0,3,0) — all of which beat a bare .arco-btn-primary. Every rule
now uses .arco-btn.arco-btn-X[type='...'] so the skin wins regardless of
the rendered html-type; login is a submit button, which is why it stayed
solid.

Verified with jsdom computed styles against the real arco.css.

Also remove the default-credential chips from the login page: printing
admin / 123456 on a sign-in screen leaks the credentials of a reachable
deployment. The one-click fill shortcut stays. The test that asserted
the hint is now shown is inverted to assert it is absent.

tests/client/login-view.test.ts

@@ -84,10 +84,22 @@ describe('LoginView password login', () => {
     expect(mockReplace).toHaveBeenCalledWith('/hermes/chat')
   })
 
-  it('shows the default login hint', () => {
+  it('does not expose the default credentials, but keeps the fill shortcut', async () => {
     const wrapper = mount(LoginView)
 
-    expect(wrapper.text()).toContain('login.defaultCredentialsHint')
+    // 默认账号密码不再直接印在页面上（生产环境不该展示登录凭据）。
+    expect(wrapper.text()).not.toContain('login.defaultCredentialsHint')
+    expect(wrapper.text()).not.toContain('admin')
+    expect(wrapper.text()).not.toContain('123456')
+
+    // 但保留一键填入入口，方便本地开发。
+    const fill = wrapper.find('.login-copy')
+    expect(fill.exists()).toBe(true)
+    await fill.trigger('click')
+
+    const inputs = wrapper.findAll('input.login-input')
+    expect(inputs[0].element.value).toBe('admin')
+    expect(inputs[1].element.value).toBe('123456')
   })
 
   it('shows an error when password login fails', async () => {