llmgw stop, start and restart act on the whole system

Issue #3 asked for commands to stop and start the system, and 05aa21c gave
only one machine's services. Now:

- llmgw stop sets serving.stopped in the cluster's settings, live: the
  reconciler wants every model at no replicas, freeing every GPU, and the
  gateway answers every POST under /v1/ with 503 system_stopped. The control
  planes, agents and mirror keep running, and no model's definition changes.
- llmgw start clears it; every model is placed again as it asks.
- llmgw restart has every agent restart over its stream (RestartAgent), then
  the other control planes over ssh, standbys before a leader, then this
  one; engines keep serving.
- llmgw status is the cluster's summary, saying when it is stopped.

One machine's services moved to llmgw service status|start|stop|restart.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/reference.md

@@ -290,6 +290,7 @@ rather than repeated.
 | `secrets` | `Secrets` | [Server](#server) |
 | `notify` | `notify.Config` | [Server](#server) |
 | `mail` | `mail.Config` | [Server](#server) |
+| `serving` | `ServingSettings` | [Server](#server) |
 | `firewall` | `FirewallSettings` | [Server](#server) |
 | `firewall_networks` | `[]string` | [Server](#server) |
 | `backup_recipients` | `[]string` | [Server](#server) |
@@ -302,6 +303,7 @@ rather than repeated.
 | `facility` | `Facility` | [Server](#server) |
 | `federation` | `Federation` | [Server](#server) |
 | `endpoints` | `[]Endpoint` | [Server](#server) |
+| `stopped` | `bool` | [ServingSettings](#servingsettings) |
 | `bin` | `string` | [SimConfig](#simconfig) |
 | `python` | `string` | [TRTLLMConfig](#trtllmconfig) |
 | `store` | `string` | [Threads](#threads) |
@@ -2481,6 +2483,15 @@ forgotten password. Unset, none is sent and people ask an operator.
 
 Takes a [mail.Config](#mailconfig) block.
 
+### `serving`
+
+`ServingSettings`
+
+Serving stops and starts the whole cluster's service (llmgw stop, llmgw
+start).
+
+Takes a [ServingSettings](#servingsettings) block.
+
 ### `firewall`
 
 `FirewallSettings`
@@ -2579,6 +2590,18 @@ Endpoints is the phase-1 static replica list. It is only consulted when
 no model declares a profile, which is what makes a router-only smoke test
 against sim-engines possible without a control plane.
 
+## ServingSettings
+
+### `stopped`
+
+`bool`
+
+Stopped takes every model down and answers every request for one with
+503 (system_stopped), leaving the control planes, agents and mirror
+running and every model's definition as it is: llmgw stop sets it,
+llmgw start clears it, and the models come back as their catalog
+entries ask. In force on every control plane within seconds.
+
 ## SimConfig
 
 ### `bin`