Lock admin monitor and channel writes behind NOMINAL_API_MANAGED

[tomschlick]

Summary

• Add NOMINAL_API_MANAGED so monitor and notification-channel create, edit, and delete are locked in the Filament admin for Terraform-managed installs.
• Grey out those controls and show why, while Pause, Resume, maintenance, Check now, and Send test stay available.
• GraphQL mutations are unchanged; Livewire create/save is refused with 403 when the flag is on.

Test plan

• With the flag off, create, edit, and delete a monitor and a notification channel as usual.
• Set NOMINAL_API_MANAGED=true and confirm Create, Duplicate, Delete, and Save are disabled with the API-managed message.
• Confirm Pause, Resume, Start maintenance, Check now, and Send test still work.
• Confirm GraphQL/Terraform create still succeeds with the flag on.
• Confirm Settings → General shows API-managed resources as On or Off.