Global kill-switch state. Distinct from any service's own flag — a service
reports on: false from listServices while global is on, because
that field is its per-service flag. Effective state is the OR of the two.
Flips the global kill-switch, gating every process that runs the gate — including services that never registered, which no per-service toggle can reach. The control plane (this dashboard) is exempt by construction.
Admin-side maintenance toggle: composes the Valkey-only MaintenanceService with a durable Postgres audit write.
MaintenanceServicelives in@cfxlabsinc/maintenance-servicesand is Valkey-only (no db handle). This service wraps it so the admin dashboard can flip a service's maintenance flag while recording a durable audit row inadmin.dashboard_user_activity. The audit row is written FIRST inside a transaction — if the Valkey flip fails the toggle is still audited, and a non-durable flag that's out of sync with the audit log is recoverable (re-run the toggle); a missing audit row is not.