Distinguish disabled from removed backend state; add make fixstyle

Add StateDisabled for operator-initiated disable, keeping StateRemoved
for backends that disappear during a config reload. Previously both
used StateRemoved, which was confusing: "removed" implies the backend
no longer exists in config, but a disabled backend is still present
and can be re-enabled on the fly.

- health: add StateDisabled with String() "disabled", Disable() method
  with probe code "disabled". Record() rejects probes in all three
  inactive states (paused, disabled, removed).
- checker: DisableBackend calls backend.Disable() instead of Remove().
- docs: healthchecks.md rewritten for pause (goroutine cancelled, not
  just results discarded), and separate disabled/removed state rows.
  user-guide.md updated to match.
- Makefile: add fixstyle target (gofmt -w .).

Makefile

@@ -14,7 +14,7 @@ LDFLAGS      := -X '$(MODULE)/cmd.version=$(VERSION)' \
 
 TEST ?= tests/
 
-.PHONY: all build build-amd64 build-arm64 test proto lint pkg-deb robot-test clean
+.PHONY: all build build-amd64 build-arm64 test proto lint fixstyle pkg-deb robot-test clean
 
 all: build
 
@@ -48,6 +48,9 @@ $(GEN_FILES): $(PROTO_FILE)
 		--go-grpc_out=. --go-grpc_opt=module=$(MODULE) \
 		$(PROTO_FILE)
 
+fixstyle:
+	gofmt -w .
+
 lint:
 	golangci-lint run ./...