feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/pages/AdminDashboard.tsx

@@ -7,6 +7,7 @@ import SystemHealthTab from '../components/admin/SystemHealthTab';
 import UserOverviewTab from '../components/admin/UserOverviewTab';
 import NotificationBroadcastTab from '../components/admin/NotificationBroadcastTab';
 import BannerManagementTab from '../components/admin/BannerManagementTab';
+import ServiceModeTab from '../components/admin/ServiceModeTab';
 import { useAuth } from '../contexts/AuthContext';
 
 interface TabPanelProps {
@@ -41,6 +42,7 @@ function AdminDashboard() {
           <Tab label="Benutzer" />
           <Tab label="Broadcast" />
           <Tab label="Banner" />
+          <Tab label="Wartung" />
         </Tabs>
       </Box>
 
@@ -59,6 +61,9 @@ function AdminDashboard() {
       <TabPanel value={tab} index={4}>
         <BannerManagementTab />
       </TabPanel>
+      <TabPanel value={tab} index={5}>
+        <ServiceModeTab />
+      </TabPanel>
     </DashboardLayout>
   );
 }