feat(app): implement MAINTENANCE_MODE + configure Claude Code security hooks

- Add VITE_MAINTENANCE_MODE guard in main.tsx (no providers mount when true)
- Create static MaintenancePage.tsx (Direction H tokens, zero dependencies)
- Register VITE_MAINTENANCE_MODE in env.ts (optional, defaults to false)
- Add PreToolUse security hook (9 patterns from SECURITY.md §2)
- Add Stop hook for file size check (>200 lines warning)
- Register Semgrep MCP server
- Update ARCHITECTURE.md §7 (new env var)
- Resolve FTD-16 in TECH_DEBT.md

src/app/MaintenancePage.tsx

@@ -0,0 +1,24 @@
+import { Logo } from '@/shared/components/Logo'
+
+export function MaintenancePage() {
+  return (
+    <div className="flex min-h-screen flex-col items-center justify-center gap-6 bg-canvas px-4 text-center">
+      <Logo size="md" />
+      <div className="space-y-2">
+        <h1 className="text-2xl font-semibold text-ink-1">Maintenance en cours</h1>
+        <p className="text-sm text-ink-3">
+          Expria est temporairement indisponible. Revenez dans quelques instants.
+        </p>
+      </div>
+      <p className="text-xs text-ink-4">
+        Des questions ?{' '}
+        <a
+          href="mailto:support@expria.ca"
+          className="text-expria underline-offset-4 hover:underline"
+        >
+          support@expria.ca
+        </a>
+      </p>
+    </div>
+  )
+}

src/app/main.tsx

@@ -1,6 +1,8 @@
 import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 import { Providers } from './providers'
+import { MaintenancePage } from './MaintenancePage'
+import { isMaintenanceMode } from '@/shared/config/env'
 import '../index.css'
 
 const container = document.getElementById('root')
@@ -10,6 +12,6 @@ if (!container) {
 
 createRoot(container).render(
   <StrictMode>
-    <Providers />
+    {isMaintenanceMode ? <MaintenancePage /> : <Providers />}
   </StrictMode>,
 )

src/shared/config/env.ts

@@ -6,6 +6,7 @@ const envSchema = z.object({
   VITE_SUPABASE_ANON_KEY: z.string().min(1),
   VITE_ENABLE_T2_LIVE: z.enum(['true', 'false']).optional(),
   VITE_SENTRY_DSN: z.string().url().optional(),
+  VITE_MAINTENANCE_MODE: z.enum(['true', 'false']).optional(),
 })
 
 const parsed = envSchema.safeParse(import.meta.env)
@@ -18,3 +19,4 @@ if (!parsed.success) {
 }
 
 export const env = parsed.data
+export const isMaintenanceMode = parsed.data.VITE_MAINTENANCE_MODE === 'true'