fix(frontend): Strip confirmPassword before API calls; add pointer cursor

- Destructure confirmPassword out of form values in SetupPage and
  InviteCompletePage so it is never sent to the backend
- Add global cursor:pointer rule for buttons, selects, labels and links

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/src/index.css

@@ -110,6 +110,10 @@
         -moz-osx-font-smoothing: grayscale;
     }
 
+    button, [role="button"], select, label[for], a[href], [tabindex]:not([tabindex="-1"]) {
+        cursor: pointer;
+    }
+
     /* Visible focus ring for keyboard navigation (NFR-U1-02 / Q2-A). */
     :focus-visible {
         outline: 2px solid var(--color-ring);

frontend/src/pages/InviteCompletePage.tsx

@@ -68,10 +68,8 @@ export function InviteCompletePage() {
                 setLoadingState('error');
                 return;
             }
-            await completeMutation.mutateAsync({
+            const { confirmPassword: _, ...fields } = values;
-                token,
+            await completeMutation.mutateAsync({ token, ...fields });
-                ...values
-            });
             setLoadingState('success');
             setTimeout(() => {
                 navigate({ to: '/login' });

frontend/src/pages/SetupPage.tsx

@@ -45,7 +45,8 @@ export function SetupPage() {
     const onSubmit = handleSubmit(async (values) => {
         setServerError(null);
         try {
-            await setupMutation.mutateAsync(values);
+            const { confirmPassword: _, ...payload } = values;
+            await setupMutation.mutateAsync(payload);
             setSuccessMessage(true);
             setTimeout(() => {
                 navigate({ to: '/login' });