Distinguish disabled from removed backend state; add make fixstyle

Add StateDisabled for operator-initiated disable, keeping StateRemoved
for backends that disappear during a config reload. Previously both
used StateRemoved, which was confusing: "removed" implies the backend
no longer exists in config, but a disabled backend is still present
and can be re-enabled on the fly.

- health: add StateDisabled with String() "disabled", Disable() method
  with probe code "disabled". Record() rejects probes in all three
  inactive states (paused, disabled, removed).
- checker: DisableBackend calls backend.Disable() instead of Remove().
- docs: healthchecks.md rewritten for pause (goroutine cancelled, not
  just results discarded), and separate disabled/removed state rows.
  user-guide.md updated to match.
- Makefile: add fixstyle target (gofmt -w .).

internal/checker/checker.go

@@ -350,7 +350,7 @@ func (c *Checker) DisableBackend(name string) (BackendSnapshot, bool) {
 		return BackendSnapshot{Health: w.backend, Config: w.entry}, true
 	}
 	maxHistory := c.cfg.HealthChecker.TransitionHistory
-	t := w.backend.Remove(maxHistory)
+	t := w.backend.Disable(maxHistory)
 	slog.Info("backend-disable", "backend", name)
 	c.emitForBackend(name, w.backend.Address, t, c.cfg.Frontends)
 	w.cancel()

internal/checker/checker_test.go

@@ -310,8 +310,8 @@ func TestEnableDisable(t *testing.T) {
 	if !ok {
 		t.Fatal("DisableBackend: not found")
 	}
-	if b.Health.State != health.StateRemoved {
-		t.Errorf("after disable: state=%s, want removed", b.Health.State)
+	if b.Health.State != health.StateDisabled {
+		t.Errorf("after disable: state=%s, want disabled", b.Health.State)
 	}
 	if b.Config.Enabled {
 		t.Error("after disable: Enabled should be false")