outrank Arco button variants and drop the credential hint

The neon tube rules never applied. Arco emits .arco-btn-primary along
with three attribute variants ([type='button'], [type='submit'],
[type='reset']) that lift specificity to (0,2,0), and their :hover forms
reach (0,3,0) — all of which beat a bare .arco-btn-primary. Every rule
now uses .arco-btn.arco-btn-X[type='...'] so the skin wins regardless of
the rendered html-type; login is a submit button, which is why it stayed
solid.

Verified with jsdom computed styles against the real arco.css.

Also remove the default-credential chips from the login page: printing
admin / 123456 on a sign-in screen leaks the credentials of a reachable
deployment. The one-click fill shortcut stays. The test that asserted
the hint is now shown is inverted to assert it is absent.

packages/client/src/i18n/locales/en.ts

@@ -12,7 +12,6 @@ export default {
     tokenLogin: 'Token',
     usernamePlaceholder: 'Username',
     passwordPlaceholder: 'Password',
-    defaultCredentialsHint: 'Default username: admin. Default password: 123456.',
     credentialsRequired: 'Please enter username and password',
     invalidCredentials: 'Invalid username or password',
     tooManyAttempts: 'Too many failed attempts, please try again later',
@@ -24,7 +23,7 @@ export default {
     offline: 'Cannot reach the server · you can still try to log in',
     showPassword: 'Show password',
     hidePassword: 'Hide password',
-    fillDefaultCredentials: 'Fill in admin / 123456',
+    fillDefaults: 'Sign in with the default account',
     localDeploymentNote: 'Self-hosted · no telemetry · data never leaves this machine',
     tokenHint: 'The token returned by POST /api/auth/login is stored in localStorage',
     accessDenied: 'You do not have permission to access this resource.',