Remove the no-op MAINTENANCE_MODE setting (closes #317)

MAINTENANCE_MODE only made the healthcheck report
maintenanceMode: true; no request was ever served differently. It is
removed from the configuration, the healthcheck JSON, the README and
the Settings page, together with the unused Server.MaintenanceMode
method and the healthcheck's Config dependency, which existed only to
read it. A leftover MAINTENANCE_MODE in the environment is not read,
so it is ignored rather than refused.

Model: opus-5-5

README.md

@@ -135,7 +135,6 @@ TTY detection, and security headers are always applied.
 | `BIND_ADDRESS`          | IP address the HTTP listener binds. Loopback by default, so the cleartext listener is not published on every interface. The Docker image ships `0.0.0.0` instead. See [Bind address](#bind-address) | `127.0.0.1` (image: `0.0.0.0`) |
 | `DATA_DIR`              | Directory for all SQLite databases  | `/var/lib/webhooker` |
 | `DEBUG`                 | Enable debug logging                | `false`  |
-| `MAINTENANCE_MODE`      | Report `maintenanceMode: true` in the healthcheck JSON. It does not change how any request is served — no maintenance page exists | `false`  |
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`. Must be set together with `METRICS_PASSWORD`; one without the other fails startup | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`. Must be set together with `METRICS_USERNAME`; one without the other fails startup | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN. Unset leaves error reporting off; a value the Sentry SDK cannot parse fails startup rather than serving with reporting silently off | `""`     |
@@ -515,8 +514,8 @@ no report is being sent — which is why it aborts rather than starting
 with reporting off. Leaving it unset is not a mistake and not affected:
 error reporting is simply off and startup is normal.
 
-Boolean variables (`DEBUG`, `MAINTENANCE_MODE`) accept exactly the
-spellings Go's `strconv.ParseBool` accepts — `1`, `t`, `T`, `TRUE`,
+The boolean variable `DEBUG` accepts exactly the spellings Go's
+`strconv.ParseBool` accepts — `1`, `t`, `T`, `TRUE`,
 `true`, `True`, `0`, `f`, `F`, `FALSE`, `false`, `False` — and nothing
 else. `yes`, `on`, and `off` are rejected rather than quietly treated
 as false.
@@ -2775,7 +2774,7 @@ abuse limit later; they are tracked as future work.
 | Method | Path                        | Description |
 | ------ | --------------------------- | ----------- |
 | `GET`  | `/`                         | Root redirect, 303 (authenticated → `/hooks`, unauthenticated → `/pages/login`) |
-| `GET`  | `/.well-known/healthcheck`  | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`, `maintenanceMode`) |
+| `GET`  | `/.well-known/healthcheck`  | Health check (JSON: `status`, `now`, `uptimeSeconds`, `uptimeHuman`, `version`, `appname`) |
 | `GET`, `HEAD` | `/s/*`              | Static file serving (embedded CSS, JS). `GET` and `HEAD` only — `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` and `CONNECT` are answered `405 Method Not Allowed` with `Allow: GET, HEAD`. Any other method (such as `PROPFIND`) is refused by chi before it reaches this route, and gets `405` without an `Allow` header. Pinned by `TestStaticServesOnlyGetAndHead` |
 | `POST` | `/h/{uuid}`                 | Webhook receiver endpoint. `POST` only — every other method is answered `405 Method Not Allowed` with `Allow: POST`. Rate limited (see [Rate Limiting](#rate-limiting)) |