feat: service mode (maintenance mode)

Admins can toggle maintenance mode from the admin dashboard (new
"Wartung" tab). When active, all non-admin users see a full-page
maintenance screen instead of the app.

- Backend: GET /api/config/service-mode endpoint (authenticated)
- Backend: stores state in app_settings key 'service_mode'
- Frontend: ServiceModeGuard wraps all ProtectedRoutes
- Frontend: ServiceModePage full-screen maintenance UI
- Frontend: ServiceModeTab in admin dashboard with toggle + message
- Admins (dashboard_admin group) always bypass the guard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/types/config.types.ts

@@ -4,3 +4,8 @@ export interface ExternalLinks {
   vikunja?: string;
   customLinks?: Array<{ name: string; url: string }>;
 }
+
+export interface ServiceModeStatus {
+  active: boolean;
+  message: string;
+}