fix(web): disable publish-confirm while pending; aria-current on stepper

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/objects/publish-control.tsx

@@ -56,6 +56,7 @@ export function PublishControl({ object }: { object: AdminObjectView }) {
         {STEPS.map((step, i) => (
           <div
             key={step}
+            aria-current={i === currentIndex ? "step" : undefined}
             className={`flex-1 border px-2 py-1 text-center text-xs ${
               i === currentIndex
                 ? "bg-neutral-800 font-semibold text-white"
@@ -103,7 +104,10 @@ export function PublishControl({ object }: { object: AdminObjectView }) {
               <AlertDialogDescription>{t("publish.confirmBody")}</AlertDialogDescription>
               <AlertDialogFooter>
                 <AlertDialogCancel>{t("form.cancel")}</AlertDialogCancel>
-                <AlertDialogAction onClick={() => go("public")}>
+                <AlertDialogAction
+                  disabled={setVisibility.isPending}
+                  onClick={() => go("public")}
+                >
                   {t("publish.confirm")}
                 </AlertDialogAction>
               </AlertDialogFooter>