feat: SuperAdmin server-access kill switch gate

Add /super/settings endpoints and API middleware that returns generic 503 while keeping unlock routes whitelisted.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Kernel.php

@@ -22,6 +22,7 @@ class Kernel extends HttpKernel
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
+        \App\Http\Middleware\BlockServerAccess::class,
     ];
 
     /**
@@ -69,5 +70,6 @@ class Kernel extends HttpKernel
         'pargar.auth' => \App\Http\Middleware\PargarAuth::class,
         'sms.panel.super' => \App\Http\Middleware\EnsureSmsPanelSuperAdmin::class,
         'customer.active' => \App\Http\Middleware\EnsureCustomerIsActive::class,
+        'superadmin.remote' => \App\Http\Middleware\EnsureSuperAdminRemoteToken::class,
     ];
 }