Distinguish disabled from removed backend state; add make fixstyle

Add StateDisabled for operator-initiated disable, keeping StateRemoved
for backends that disappear during a config reload. Previously both
used StateRemoved, which was confusing: "removed" implies the backend
no longer exists in config, but a disabled backend is still present
and can be re-enabled on the fly.

- health: add StateDisabled with String() "disabled", Disable() method
  with probe code "disabled". Record() rejects probes in all three
  inactive states (paused, disabled, removed).
- checker: DisableBackend calls backend.Disable() instead of Remove().
- docs: healthchecks.md rewritten for pause (goroutine cancelled, not
  just results discarded), and separate disabled/removed state rows.
  user-guide.md updated to match.
- Makefile: add fixstyle target (gofmt -w .).

docs/user-guide.md

@@ -87,7 +87,7 @@ set backend <name> pause         Suspend health checking for a backend, freezing
 set backend <name> resume        Resume health checking; backend re-enters unknown state
                                  and is probed immediately.
 set backend <name> disable       Stop probing entirely and remove the backend from rotation.
-                                 The backend remains visible (state: removed) and can be
+                                 The backend remains visible (state: disabled) and can be
                                  re-enabled without reloading configuration.
 set backend <name> enable        Re-enable a disabled backend. A fresh probe goroutine is
                                  started and the backend re-enters unknown state.