Disengage the global dispatcher kill switch

Removes the sentinel file at KILL_SWITCH_FILE. Once observed by the watcher, dispatch resumes.

Requires admin role per #18.

Idempotent. A missing sentinel file (ENOENT) is treated as success; this endpoint returns 200, never 404.

When the handler's own check of the sentinel file, made before it touches the file, finds the file present, and the file operation completes without a fatal error, the dispatcher fires the kill_switch_flipped webhook (when both SECURITY_ALERT_WEBHOOK_URL and SECURITY_ALERT_WEBHOOK_SECRET are configured) with actor set to the calling admin's GitHub username. A URL configured without a secret disables delivery entirely — the dispatcher logs a [security:webhook_disabled] warning at startup and sends nothing on this or any other security-alert event. That check is not synchronized with other writers, so the actor-attributed alert reflects what the check saw, not whether this call changed the file: concurrent calls, or an out-of-band touch/rm between the check and the removal, can make the two differ. A call whose check finds the file already absent fires no actor-attributed alert, but still runs the watcher confirmation step; if that confirmation is the first to observe an out-of-band change made since the watcher's last poll, the watcher's own notification path can emit an alert with no actor. Watcher poll-loop suppression matches the engage path.

The response's active field is the state the watcher actually confirmed after the file removal, not necessarily the requested one: if the post-removal confirmation hits a filesystem error, the removal already happened but the in-memory state could not be confirmed, and the response is 503 reporting the last known state instead of 200 with a possibly-wrong active:false. The kill_switch_flipped webhook still fires in that case, with active:false (the requested/removed state) — the file removal is the real event, and withholding the alert would mean a completed disengage could go unreported (the suppressed watcher poll won't fire it either, and a client retry afterward is a no-op).

Returns 503 {"error":"kill switch not configured"} when KILL_SWITCH_FILE is unset.