fix(frontend): Strip confirmPassword before API calls; add pointer cursor

- Destructure confirmPassword out of form values in SetupPage and
  InviteCompletePage so it is never sent to the backend
- Add global cursor:pointer rule for buttons, selects, labels and links

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/src/pages/InviteCompletePage.tsx

@@ -68,10 +68,8 @@ export function InviteCompletePage() {
                 setLoadingState('error');
                 return;
             }
-            await completeMutation.mutateAsync({
-                token,
-                ...values
-            });
+            const { confirmPassword: _, ...fields } = values;
+            await completeMutation.mutateAsync({ token, ...fields });
             setLoadingState('success');
             setTimeout(() => {
                 navigate({ to: '/login' });