Add monitor-only mode: suppress all actions without stopping EMS

New internal/monitor package provides a thread-safe, file-backed toggle.
Flag file presence (/etc/ems/monitor-only) = monitor-only active, survives
reboots. Deletion = resume normal operation.

Behaviour when active:
- EMS continues polling Prometheus, running the decision engine, and
  updating the status page every 2 minutes — full visibility maintained
- All actuator calls suppressed (Shelly switches + Viessmann WW writes)
- Suppressed actions logged as [MONITOR-ONLY] for audit trail
- Startup warns if flag file is already present

Web UI:
- Amber banner "⏸ Monitor-Only — Keine Schaltvorgänge" with inline
  "▶ Automatik" resume button when active
- Small unobtrusive "⏸ Monitor-Only" button at page bottom when inactive
- POST /monitor endpoint toggles state and redirects back to status page

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

configs/ems-config.yaml

@@ -111,3 +111,4 @@ ems:
   recovery_timeout: "1h"             # ignore Shelly state if EMS was down longer
   override_timeout: "1h"             # default lockout when EMS detects external Shelly change
   override_max_import_w: 800         # cancel override immediately if importing more than this (0 = disabled)
+  monitor_only_file: "/etc/ems/monitor-only"  # presence of this file = monitor-only mode active