feat(design): every button on its family, the chip primitive, the lint rule (E28 S3b2)

The second half of the button sweep: the remaining hand-rolled buttons in
feature components, the design lab and the components/ui composites now
stand on Button, IconButton, Pressable, Chip or DragHandle.

- Chip + DismissibleChip (filter / token / tag / suggest / ghost, 24px
  floor, 44 on touch) replace five chip geometries; FilterChipGroup
  renders Chips; overflow lanes measure a mirror painted by chipClass.
- The Plex control row is IconButton's player rung (36, 20px glyph,
  round, overlay; 44 on touch); the YT modal bar is on the sm rung with
  pressed cycle toggles and names that survive a folded label.
- New variants: IconButton ghost-accent, danger-soft; Button warn on a
  new state-warn utility. The .btn-{tone} recipes and btnCls are gone.
- Fixed on the way: membership rows (collection editor, Plex playlist
  add) announce checked/mixed; a one-letter tag chip was 21px wide;
  descriptionLinks moved out of lib/ (it renders components).
- local/button-primitive: a raw <button>/<FocusSafeButton> outside the
  control-primitive files is a lint error (contract-tested, seen red).

frontend/src/components/KeyGate.tsx

@@ -172,9 +172,9 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
         {configured ? t("messages.unlock") : t("messages.setUp")}
       </Button>
       {configured && (
-        <button onClick={toReset} className="block text-xs text-muted hover:text-fg">
+        <Button variant="link-muted" onClick={toReset} className="text-xs">
           {t("messages.forgotPass")}
-        </button>
+        </Button>
       )}
       {!configured && !compact && <p className="text-xs text-muted">{t("messages.setupWarn")}</p>}
     </div>