Wire maintenance page into deploy script as a dynamic toggle

Replaces the earlier auto-fallback-on-upstream-error approach with an
explicit flag-file toggle controlled by the deploy script. The flag
is touched before stopping the app and removed on successful finish
(or via trap if the deploy aborts), so a failed deploy doesn't strand
the site in maintenance.

- nginx/goodwalk.co.nz.svelte.conf.example: error_page 503 routes to
  /maintenance.html (internal); /m/ serves static maintenance assets;
  the / and /api/submit blocks return 503 when /etc/nginx/conf.d/
  maintenance.flag exists.
- nginx/maintenance.html: brand-styled "Be right back" page — full
  Goodwalk green background, white card with yellow accent, real
  Goodwalk logo, contact details fallback, auto-reload after 60s.
- nginx/logo.png: maintenance-time logo (served from /m/logo.png).
- nginx/nginx.conf: reverted the earlier auto-fallback edits; this
  file is not deployed (the prod conf is goodwalk.co.nz.svelte.conf
  .example).
- scripts/deploy-remote.sh: copies maintenance.html + logo into the
  nginx container, reloads nginx so the new conf is live, touches
  the flag, then runs the rebuild, then clears the flag. Adds a
  trap-based clear_maintenance_flag fallback. Also adds a defensive
  env-file merger that appends new keys from deploy.env.template
  without clobbering live values, with a timestamped .env backup.

Plus a small a11y polish unrelated to maintenance:
- ServicesSection: "Learn more" links now include screen-reader-only
  "about <Service>" context.
- base.css: adds .visually-hidden utility class.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

nginx/goodwalk.co.nz.svelte.conf.example

@@ -53,6 +53,26 @@ server {
     # nginx does not keep stale upstream IPs in memory.
     resolver 127.0.0.11 ipv6=off valid=30s;
 
+    # Maintenance mode: when /etc/nginx/conf.d/maintenance.flag exists,
+    # serve the static "be right back" page with a 503 status. The flag is
+    # toggled by the deploy script (touch / rm) without reloading nginx.
+    error_page 503 /maintenance.html;
+
+    location = /maintenance.html {
+        root /var/www/html;
+        internal;
+        add_header Cache-Control "no-store" always;
+    }
+
+    # Static assets used only by the maintenance page (logo, etc.). Served
+    # directly from the nginx html mount so they remain reachable while the
+    # SvelteKit app is down.
+    location /m/ {
+        root /var/www/html;
+        access_log off;
+        add_header Cache-Control "public, max-age=3600" always;
+    }
+
     location ~* /\.(git|env|htaccess) {
         deny all;
     }
@@ -66,6 +86,10 @@ server {
     }
 
     location /api/submit {
+        if (-f /etc/nginx/conf.d/maintenance.flag) {
+            return 503;
+        }
+
         set $goodwalk_mail_api goodwalk_svelte_mail_api:8000;
         limit_req zone=goodwalk_limit burst=10 nodelay;
         proxy_pass http://$goodwalk_mail_api/submit;
@@ -77,6 +101,10 @@ server {
     }
 
     location / {
+        if (-f /etc/nginx/conf.d/maintenance.flag) {
+            return 503;
+        }
+
         set $goodwalk_frontend goodwalk_svelte_app:3000;
         proxy_pass http://$goodwalk_frontend;
         proxy_http_version 1.1;