feat(13-02): gate POST /api/pax8/sync on the disabled toggle

- Return 403 when integration_settings.key='pax8' has disabled=true
- Check runs as the first statement, before isSyncInProgress()
- GET handler unchanged; no new imports (postgresClient already imported)

app/api/pax8/sync/route.ts

@@ -3,6 +3,16 @@ import { getPax8SyncService } from '@/lib/services/pax8-sync-service';
 import postgresClient from '@/lib/services/postgres-client';
 
 export async function POST(req: NextRequest) {
+  const disabledRes = await postgresClient.query<{ disabled: boolean }>(
+    `SELECT disabled FROM integration_settings WHERE key = 'pax8'`
+  );
+  if (disabledRes.rows[0]?.disabled === true) {
+    return NextResponse.json(
+      { error: 'PAX8 is disabled', message: 'PAX8 sync is disabled via /admin/integrations' },
+      { status: 403 }
+    );
+  }
+
   const body = await req.json().catch(() => ({}));
   const triggeredBy = body.triggeredBy || 'manual';