fix(frontend): Strip confirmPassword before API calls; add pointer cursor

- Destructure confirmPassword out of form values in SetupPage and
  InviteCompletePage so it is never sent to the backend
- Add global cursor:pointer rule for buttons, selects, labels and links

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/src/index.css

@@ -110,6 +110,10 @@
         -moz-osx-font-smoothing: grayscale;
     }
 
+    button, [role="button"], select, label[for], a[href], [tabindex]:not([tabindex="-1"]) {
+        cursor: pointer;
+    }
+
     /* Visible focus ring for keyboard navigation (NFR-U1-02 / Q2-A). */
     :focus-visible {
         outline: 2px solid var(--color-ring);