feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/config.routes.ts

@@ -4,5 +4,6 @@ import { authenticate } from '../middleware/auth.middleware';
 
 const router = Router();
 router.get('/external-links', authenticate, configController.getExternalLinks.bind(configController));
+router.get('/service-mode', authenticate, configController.getServiceMode.bind(configController));
 
 export default router;