Wire maintenance page into deploy script as a dynamic toggle

Replaces the earlier auto-fallback-on-upstream-error approach with an
explicit flag-file toggle controlled by the deploy script. The flag
is touched before stopping the app and removed on successful finish
(or via trap if the deploy aborts), so a failed deploy doesn't strand
the site in maintenance.

- nginx/goodwalk.co.nz.svelte.conf.example: error_page 503 routes to
  /maintenance.html (internal); /m/ serves static maintenance assets;
  the / and /api/submit blocks return 503 when /etc/nginx/conf.d/
  maintenance.flag exists.
- nginx/maintenance.html: brand-styled "Be right back" page — full
  Goodwalk green background, white card with yellow accent, real
  Goodwalk logo, contact details fallback, auto-reload after 60s.
- nginx/logo.png: maintenance-time logo (served from /m/logo.png).
- nginx/nginx.conf: reverted the earlier auto-fallback edits; this
  file is not deployed (the prod conf is goodwalk.co.nz.svelte.conf
  .example).
- scripts/deploy-remote.sh: copies maintenance.html + logo into the
  nginx container, reloads nginx so the new conf is live, touches
  the flag, then runs the rebuild, then clears the flag. Adds a
  trap-based clear_maintenance_flag fallback. Also adds a defensive
  env-file merger that appends new keys from deploy.env.template
  without clobbering live values, with a timestamped .env backup.

Plus a small a11y polish unrelated to maintenance:
- ServicesSection: "Learn more" links now include screen-reader-only
  "about <Service>" context.
- base.css: adds .visually-hidden utility class.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

nginx/nginx.conf

@@ -29,14 +29,6 @@ server {
   gzip on;
   gzip_types text/plain text/css application/javascript application/json image/svg+xml;
 
-  # Served when the SvelteKit upstream is unreachable (deploys, restarts).
-  # Mounted into the nginx container at /var/www/html/maintenance.html.
-  location = /maintenance.html {
-    root /var/www/html;
-    internal;
-    add_header Cache-Control "no-store" always;
-  }
-
   location /api/submit {
     proxy_pass http://mail-api:8000/submit;
     proxy_http_version 1.1;
@@ -44,10 +36,6 @@ server {
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
-
-    proxy_intercept_errors on;
-    proxy_connect_timeout 2s;
-    error_page 502 503 504 = /maintenance.html;
   }
 
   location / {
@@ -59,13 +47,5 @@ server {
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";
-
-    # Serve a static maintenance page when the app container is down/restarting,
-    # rather than nginx's default 502/503. The `=` keeps the original status
-    # code so search engines treat it as a transient outage, not a real page.
-    proxy_intercept_errors on;
-    proxy_connect_timeout 2s;
-    proxy_next_upstream error timeout http_502 http_503 http_504;
-    error_page 502 503 504 = /maintenance.html;
   }
 }