feat(app): implement MAINTENANCE_MODE + configure Claude Code security hooks

- Add VITE_MAINTENANCE_MODE guard in main.tsx (no providers mount when true)
- Create static MaintenancePage.tsx (Direction H tokens, zero dependencies)
- Register VITE_MAINTENANCE_MODE in env.ts (optional, defaults to false)
- Add PreToolUse security hook (9 patterns from SECURITY.md §2)
- Add Stop hook for file size check (>200 lines warning)
- Register Semgrep MCP server
- Update ARCHITECTURE.md §7 (new env var)
- Resolve FTD-16 in TECH_DEBT.md

docs/ARCHITECTURE.md

@@ -550,6 +550,7 @@ VITE_SUPABASE_URL=https://xxx.supabase.co
 VITE_SUPABASE_ANON_KEY=xxx
 VITE_ENABLE_T2_LIVE=false         # flag pour cacher T2 en prod tant que pas prêt
 VITE_SENTRY_DSN=xxx                # optionnel, pour monitoring
+VITE_MAINTENANCE_MODE=false       # true = affiche MaintenancePage avant tout provider
 ```
 
 ### Règle absolue