feat(firewall): add operational status reads

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

core/lib/Service/SystemFirewallStatusService.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+
+final class SystemFirewallStatusService
+{
+    public const PERMISSION_MAINTENANCE_READ = 'firewall.system.maintenance.read';
+
+    public function __construct(
+        private readonly FirewallStatusService $status,
+        private readonly IdentityContextInterface $identity,
+    ) {
+    }
+
+    public function metrics(?string $tenantId = null, ?string $since = null): array
+    {
+        $this->requirePermission(SystemFirewallLogService::PERMISSION_READ);
+        return $this->status->systemMetrics($tenantId, $since);
+    }
+
+    public function maintenanceStatus(): array
+    {
+        $this->requirePermission(self::PERMISSION_MAINTENANCE_READ);
+        return $this->status->maintenanceStatus();
+    }
+
+    private function requirePermission(string $permission): void
+    {
+        if (!$this->identity->hasPermission($permission)) {
+            throw new \RuntimeException("Missing required permission: {$permission}");
+        }
+    }
+}