feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/services/config.ts

@@ -1,5 +1,5 @@
 import { api } from './api';
-import type { ExternalLinks } from '../types/config.types';
+import type { ExternalLinks, ServiceModeStatus } from '../types/config.types';
 
 interface ApiResponse<T> {
   success: boolean;
@@ -12,4 +12,9 @@ export const configApi = {
       .get<ApiResponse<ExternalLinks>>('/api/config/external-links')
       .then((r) => r.data.data);
   },
+  getServiceMode(): Promise<ServiceModeStatus> {
+    return api
+      .get<ApiResponse<ServiceModeStatus>>('/api/config/service-mode')
+      .then((r) => r.data.data);
+  },
 };