fix(ui): no button drops the keyboard focus when its own action disables it

A focused button that turns natively disabled loses the focus to <body> in
Chrome. The app disables the very button that was pressed on ~60 sites — a
mutation pending, a pager at its last page, undo with nothing left, a player
at the end of its queue, a form gone clean — so a keyboard user was thrown
out of the page on every such press.

One primitive instead of a fix per site: ui/FocusSafeButton renders a
focused-and-disabled (or busy) button as aria-disabled with a click guard,
and applies the native attribute again once the focus is elsewhere. It asks
the document at render time as well as listening for focus events, because
a window without focus fires none (measured). ui/Button and ui/form's Switch
are built on it; 57 hand-rolled buttons swapped their tag for it keeping
their classes, and three hand-copies of the rule (the channel page's Block
and Hide, ChannelDiscovery's Subscribe) now pass `busy`. The soft state's
dim look is one rule in index.css.

`local/focus-safe-disabled` refuses a new raw <button disabled>, pinned by
focusSafe.contract.test.ts. lib/plexDetailUi moved to components/: it is
components, and lib may not import the primitive.

Measured on localdev in Chrome: the audit log's Next button keeps the focus
on reaching the last page, reads aria-disabled, and the guarded click does
nothing.

frontend/src/index.css

@@ -88,6 +88,14 @@
     outline: 2px solid var(--accent);
     outline-offset: 2px;
   }
+
+  /* ui/FocusSafeButton's soft-disabled state (a focused button its caller disabled, or a busy one):
+     `aria-disabled` instead of the native attribute, so a caller's `disabled:*` utilities do not see
+     it. One look for all of them, in base so a component's own aria-disabled style wins. */
+  [data-focus-safe][aria-disabled="true"] {
+    opacity: 0.5;
+    cursor: not-allowed;
+  }
 }
 
 :root {