feat(app): implement MAINTENANCE_MODE + configure Claude Code security hooks

- Add VITE_MAINTENANCE_MODE guard in main.tsx (no providers mount when true)
- Create static MaintenancePage.tsx (Direction H tokens, zero dependencies)
- Register VITE_MAINTENANCE_MODE in env.ts (optional, defaults to false)
- Add PreToolUse security hook (9 patterns from SECURITY.md §2)
- Add Stop hook for file size check (>200 lines warning)
- Register Semgrep MCP server
- Update ARCHITECTURE.md §7 (new env var)
- Resolve FTD-16 in TECH_DEBT.md

src/shared/config/env.ts

@@ -6,6 +6,7 @@ const envSchema = z.object({
   VITE_SUPABASE_ANON_KEY: z.string().min(1),
   VITE_ENABLE_T2_LIVE: z.enum(['true', 'false']).optional(),
   VITE_SENTRY_DSN: z.string().url().optional(),
+  VITE_MAINTENANCE_MODE: z.enum(['true', 'false']).optional(),
 })
 
 const parsed = envSchema.safeParse(import.meta.env)
@@ -18,3 +19,4 @@ if (!parsed.success) {
 }
 
 export const env = parsed.data
+export const isMaintenanceMode = parsed.data.VITE_MAINTENANCE_MODE === 'true'