AI Issue: Reject writes at Resource API layer when read-only mode is active

Follow-up from #450 (Read-only mode).

## Problem

When `isReadOnlyMode()` is true, write operations (`PUT`, `PATCH`, `POST`, `DELETE`) currently fail at the storage engine with a generic "Database is read-only" error. That's correct behavior, but:

- The request still passes through auth checks and the `transactional` wrapper before being rejected.
- The error surfaced to the client doesn't communicate *why* the operation was rejected.

## Proposed change

In `resources/Resource.ts`, inside the `transactional` wrapper, short-circuit:

```ts
if (isReadOnlyMode() && (type === 'update' || type === 'create' || type === 'delete')) {
throw new ClientError('Server is in read-only mode', 405);
}
```

The wrapper already carries `type` metadata for each method (see `static put` / `patch` / `delete` / `post` / `invalidate` / `create`).

## Benefit

- HTTP 405 with a clear message — better client UX than a 500 from the storage layer.
- Avoids unnecessary auth + transaction setup on requests that can't succeed.

---

🤖 Identified by Gemini CLI during review of #450; relayed by Claude.