Add read-only mode and Windows service support

[MarioBinder]

Summary

• Read-only mode: Adds a READ_ONLY flag (via env var or config.yaml) that blocks all write operations. A dedicated write_router uses a require_write_access dependency to return HTTP 403 on any create/edit/delete/upload endpoint when active. The flag is exposed to the frontend, which hides all edit/delete/create buttons and locks the editor to preview mode.
• Windows Service: Adds run_service.py to run NoteDiscovery as a Windows Service using pywin32. Supports install, start, stop, remove commands.
• Service-aware startup: run.py detects when running as a Windows Service and disables --reload and console output accordingly.
• Dependencies: pywin32 and psutil added to requirements.txt.

Test plan

• Start app normally -- verify read-only mode is off by default (config.yaml: enabled: false)
• Set READ_ONLY=true env var or read_only.enabled: true in config.yaml -- verify all write endpoints return 403
• Verify frontend hides New/Delete/Edit buttons and opens notes in preview mode when read-only
• On Windows: python run_service.py install + start -- verify service starts and NoteDiscovery is reachable
• On Windows: python run_service.py stop + remove -- verify clean shutdown

[gamosoft]

Thanks for the PR, especially the Windows service support effort.

For the read-only part, we can already enforce that at deployment level (for example Docker volume mounts with :ro), so we may not need to add app-level read-only logic right now.

For Windows service support: this might be somewhat useful, but it's a bit niche, and I'd like to keep it outside core app code (I run it myself under Ubuntu!). Another approach could be to install NoteDiscovery as a Windows service using external tooling (e.g. NSSM or a PowerShell setup script, although untested) that runs python run.py. This gives users proper service behavior (auto-start, restart, background operation) without adding platform-specific dependencies/maintenance in the main codebase.

I appreciate the contribution but as I mention looks a little too specific to be part of the core stuff (adding dependencies etc etc) IMHO, what do you think?

[MarioBinder]

Thanks for the detailed feedback!

To give some context: I'm hosting NoteDiscovery natively on a Windows server (no Docker available in that environment), so the :ro mount approach wasn't an option for me. I tried both NSSM and a PowerShell-based setup to run it as a Windows service, but couldn't get either to work reliably — that's what led me to run_service.py.

The read-only mode came from the same context: without Docker, I needed an app-level way to prevent writes on that particular instance.

I completely understand if these are too niche/platform-specific for the core codebase. Happy to maintain them as a separate fork for my use case.

Thanks again for taking the time to review!