AI Issue: Reject writes at Resource API layer when read-only mode is active

[heskew]

Follow-up from #450 (Read-only mode).

Problem

When isReadOnlyMode() is true, write operations (PUT, PATCH, POST, DELETE) currently fail at the storage engine with a generic "Database is read-only" error. That's correct behavior, but:

• The request still passes through auth checks and the transactional wrapper before being rejected.
• The error surfaced to the client doesn't communicate why the operation was rejected.

Proposed change

In resources/Resource.ts, inside the transactional wrapper, short-circuit:

if (isReadOnlyMode() && (type === 'update' || type === 'create' || type === 'delete')) {
  throw new ClientError('Server is in read-only mode', 405);
}

The wrapper already carries type metadata for each method (see static put / patch / delete / post / invalidate / create).

Benefit

• HTTP 405 with a clear message — better client UX than a 500 from the storage layer.
• Avoids unnecessary auth + transaction setup on requests that can't succeed.

---

🤖 Identified by Gemini CLI during review of #450; relayed by Claude.