feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/auth/ProtectedRoute.tsx

@@ -2,6 +2,7 @@ import React from 'react';
 import { Navigate } from 'react-router-dom';
 import { useAuth } from '../../contexts/AuthContext';
 import { Box, CircularProgress, Typography } from '@mui/material';
+import ServiceModeGuard from '../shared/ServiceModeGuard';
 
 interface ProtectedRouteProps {
   children: React.ReactNode;
@@ -36,8 +37,8 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     return <Navigate to="/login" replace state={{ from: window.location.pathname + window.location.search }} />;
   }
 
-  // User is authenticated, render children
-  return <>{children}</>;
+  // User is authenticated, apply service mode guard then render children
+  return <ServiceModeGuard>{children}</ServiceModeGuard>;
 };
 
 export default ProtectedRoute;