feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/controllers/config.controller.ts

@@ -3,6 +3,16 @@ import environment from '../config/environment';
 import settingsService from '../services/settings.service';
 
 class ConfigController {
+  async getServiceMode(_req: Request, res: Response): Promise<void> {
+    try {
+      const setting = await settingsService.get('service_mode');
+      const value = setting?.value ?? { active: false, message: '' };
+      res.json({ success: true, data: value });
+    } catch {
+      res.json({ success: true, data: { active: false, message: '' } });
+    }
+  }
+
   async getExternalLinks(_req: Request, res: Response): Promise<void> {
     const envLinks: Record<string, string> = {};
     if (environment.nextcloudUrl) envLinks.nextcloud = environment.nextcloudUrl;

backend/src/routes/config.routes.ts

@@ -4,5 +4,6 @@ import { authenticate } from '../middleware/auth.middleware';
 
 const router = Router();
 router.get('/external-links', authenticate, configController.getExternalLinks.bind(configController));
+router.get('/service-mode', authenticate, configController.getServiceMode.bind(configController));
 
 export default router;