feat: SuperAdmin server-access kill switch gate

Add /super/settings endpoints and API middleware that returns generic 503 while keeping unlock routes whitelisted.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Super/SuperSettingsController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Super;
+
+use App\Http\Controllers\Controller;
+use App\Http\Middleware\BlockServerAccess;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+
+class SuperSettingsController extends Controller
+{
+    public function show()
+    {
+        $blocked = (bool) Cache::get(BlockServerAccess::CACHE_KEY, false);
+
+        return response()->json([
+            'server_access_blocked' => $blocked,
+        ]);
+    }
+
+    public function update(Request $request)
+    {
+        $data = $request->validate([
+            'server_access_blocked' => 'sometimes|boolean',
+        ]);
+
+        if (array_key_exists('server_access_blocked', $data)) {
+            $blocked = (bool) $data['server_access_blocked'];
+            if ($blocked) {
+                Cache::forever(BlockServerAccess::CACHE_KEY, true);
+            } else {
+                Cache::forget(BlockServerAccess::CACHE_KEY);
+            }
+        }
+
+        return response()->json([
+            'ok' => true,
+            'server_access_blocked' => (bool) Cache::get(BlockServerAccess::CACHE_KEY, false),
+        ]);
+    }
+}