style(overlays): refresh button as secondary; show disabled state

Two polish fixes caught in browser smoke after fa394c1:

1. Refresh from Steam is now class="button-secondary" — the brainstorm
   consensus was "normal-styled button" so it doesn't compete with the
   Add CTA, but left4me's default <button> is primary-blue, so the
   class is required to opt out.

2. Global button:disabled rule added: opacity 0.5 + cursor not-allowed.
   Was missing entirely, so the disabled attribute on Refresh-when-empty
   produced no visible change. Generic, helps any future <button disabled>
   too.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

l4d2web/l4d2web/static/css/components.css

@@ -94,6 +94,12 @@ a.button.danger {
   background: var(--color-button-danger);
 }
 
+button:disabled,
+a.button[aria-disabled="true"] {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
 .link-button {
   background: none;
   border: none;

l4d2web/l4d2web/templates/overlay_detail.html

@@ -66,7 +66,7 @@
     <span class="field-hint">{% if workshop_items_count %}{{ workshop_items_count }} item{{ "s" if workshop_items_count != 1 else "" }}{% if workshop_items_total_size %} · {{ workshop_items_total_size }} total{% endif %}{% else %}0 items{% endif %}</span>
     <form method="post" action="/overlays/{{ overlay.id }}/refresh" class="inline-form">
       <input type="hidden" name="csrf_token" value="{{ session.get('csrf_token', '') }}">
-      <button type="submit" {% if not workshop_items_count %}disabled{% endif %}>↻ Refresh from Steam</button>
+      <button type="submit" class="button-secondary" {% if not workshop_items_count %}disabled{% endif %}>↻ Refresh from Steam</button>
     </form>
   </div>
   {% endif %}