fix: button variant

[dumbdevss]

Description

closes #181

Improves the Button component with three additions:

1. Loading keeps the label visible — the spinner now renders in the leading
   icon slot while children stay in place, so short labels (e.g. "Send") no
   longer shift or disappear when loading is set.
2. iconOnly prop — renders a square button (equal height/width, no
   horizontal padding) sized per size (sm/md/lg), so icon-only buttons
   get the same focus ring and hover states as the rest of the component instead
   of relying on raw <button> elements with ad-hoc classes. While loading, the
   spinner replaces the icon entirely.
3. requireConfirm + confirmLabel props — opt-in two-click confirmation
   for dangerous actions. The first click arms the button and swaps the label to
   confirmLabel (default "Are you sure?"); the second click fires onClick.
   The prompt auto-resets on blur. Pairs naturally with variant="destructive".

All three props are optional and default to prior behavior, so existing usages
are unaffected.

// Icon-only
<Button iconOnly aria-label="Refresh"><RefreshIcon /></Button>

// Two-step destructive action
<Button variant="destructive" requireConfirm confirmLabel="Are you sure?" onClick={onDelete}>
  Delete
</Button>
Related Issues
Closes [#181](https://github.com/dumbdevss/ui/issues/181)

Type of Change
not done
Bug fix (non-breaking change which fixes an issue)
done
New feature (non-breaking change which adds functionality)
not done
Breaking change (fix or feature that would cause existing functionality to change)
not done
Documentation update
Testing
Describe how you tested your changes:

done
Component renders correctly
done
Tests added or updated for this change
done
No console errors or warnings
not done
Lint passes (npm run lint)
done
Build succeeds (npm run build)
done
Manual testing completed
Added five tests covering: label-visible-while-loading, square icon-only sizing,
spinner-replaces-icon for iconOnly loading, the two-click confirm flow, and
blur reset. Also fixed two pre-existing assertions that matched the accessible
name exactly ("Submit") where the spinner's sr-only "Loading" text makes the
name "Loading Submit" — switched to a /Submit/ matcher.

tsc --noEmit — passes
npm run build — passes
Button test suite — 17/17 passing
Note: npm run lint was not run for this PR (left unchecked above).

Checklist
done
My code follows the style guidelines of this project
done
I have performed a self-review of my own code
done
I have commented my code, particularly in hard-to-understand areas
not done
I have made corresponding changes to the documentation
done
My changes generate no new warnings

[drips-wave]

@dumbdevss Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits