fix(ui): no button drops the keyboard focus when its own action disables it

A focused button that turns natively disabled loses the focus to <body> in
Chrome. The app disables the very button that was pressed on ~60 sites — a
mutation pending, a pager at its last page, undo with nothing left, a player
at the end of its queue, a form gone clean — so a keyboard user was thrown
out of the page on every such press.

One primitive instead of a fix per site: ui/FocusSafeButton renders a
focused-and-disabled (or busy) button as aria-disabled with a click guard,
and applies the native attribute again once the focus is elsewhere. It asks
the document at render time as well as listening for focus events, because
a window without focus fires none (measured). ui/Button and ui/form's Switch
are built on it; 57 hand-rolled buttons swapped their tag for it keeping
their classes, and three hand-copies of the rule (the channel page's Block
and Hide, ChannelDiscovery's Subscribe) now pass `busy`. The soft state's
dim look is one rule in index.css.

`local/focus-safe-disabled` refuses a new raw <button disabled>, pinned by
focusSafe.contract.test.ts. lib/plexDetailUi moved to components/: it is
components, and lib may not import the primitive.

Measured on localdev in Chrome: the audit log's Next button keeps the focus
on reaching the last page, reads aria-disabled, and the guarded click does
nothing.

frontend/src/lib/focusSafe.contract.test.ts

@@ -0,0 +1,35 @@
+import { fileURLToPath } from "node:url";
+
+import { ESLint } from "eslint";
+import { describe, expect, it } from "vitest";
+
+// `local/focus-safe-disabled` (eslint.config.js): a raw `<button disabled>` throws a focused keyboard
+// user to <body> the moment it turns disabled. ~60 were swept onto ui/FocusSafeButton; this pins that
+// the rule keeping a new one out actually fires.
+const RULE = "local/focus-safe-disabled";
+const FRONTEND = fileURLToPath(new URL("../../", import.meta.url));
+
+async function hits(source: string, filePath = "src/components/__probe.tsx"): Promise<number> {
+  const eslint = new ESLint({ cwd: FRONTEND });
+  const [result] = await eslint.lintText(source, { filePath });
+  return (result?.messages ?? []).filter((m) => m.ruleId === RULE).length;
+}
+
+describe("a raw button that can be disabled", () => {
+  it("is refused, statically or not", async () => {
+    expect(
+      await hits("export const A = ({ p }: { p: boolean }) => <button disabled={p}>x</button>;\n"),
+    ).toBe(1);
+    expect(await hits("export const B = () => <button disabled>x</button>;\n")).toBe(1);
+  });
+
+  it("leaves a raw button with no disabled, and the primitive, alone", async () => {
+    expect(await hits("export const C = () => <button onClick={() => {}}>x</button>;\n")).toBe(0);
+    expect(
+      await hits(
+        "export const D = (p: { d: boolean }) => <button disabled={p.d}>x</button>;\n",
+        "src/components/ui/FocusSafeButton.tsx",
+      ),
+    ).toBe(0);
+  });
+});