Keep CCMA usable when the member store is mounted read-only

The encrypted volume holding the member data can be mounted without write
access, but starting against such a store failed: the housekeeper takes a lock
file before doing anything, so its startup pass died with a PermissionError and
took the whole start with it.

The store is now probed with an actual write once at startup -- permissions,
mount options and filesystem state all matter, and only an attempt covers them
together -- and a read-only store opens as a read-only session. The housekeeper
is skipped rather than attempted, every write inside the repository goes through
one guard that reports ReadOnlyStoreError (a RepositoryError, so the dialogs
already handle it) instead of letting an OS error surface, and the services that
archive into the member file check before they start sending or rendering.

The session says so permanently: a warning banner above the tabs, "NUR LESEN" in
the window title and status bar, and refused actions explaining why. Program
settings still save -- they live in the user's config directory -- while the
store-backed ones are skipped with a notice. "Erneut prüfen" picks up a volume
that was remounted writable without restarting.

A store that was never initialized still fails, but says that creating one needs
write access.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -183,6 +183,24 @@ marker may share the last cell. CCMA removes both markers and clones the whole
 row, including its formatting, once per item. With no items, the template row
 is removed. A loop that is not closed in the same row is rejected.
 
+## Read-only stores
+
+The member store may be mounted read-only -- the encrypted volume holding the
+member data does not have to be writable to look something up. CCMA detects this
+at startup by probing the store with an actual write, skips the housekeeper (every
+one of its passes writes) and opens in a read-only session: a permanent warning
+banner above the tabs, a "NUR LESEN" marker in the window title and status bar,
+and every write refused with one clear message instead of an operating system
+error.
+
+Program settings still save normally -- they live in the user's config directory,
+not in the store. Settings that belong to the store (club data, member numbers,
+reminders, e-mail) are skipped with a notice. When the volume is remounted with
+write access, "Erneut prüfen" in the banner picks that up without a restart.
+
+A store that was never initialized cannot be opened read-only: creating it needs
+write access, and CCMA says so instead of failing obscurely.
+
 ## Housekeeper rules
 
 The housekeeper runs every rule for every member. Built-in Python rules live in