As an alternative (or addition), perhaps a way to set a timer when enabling Read Only? Something like: Enable Read Only for: X hours.
Or maybe a special URI specifically to disable read only mode? Something like /admin/read-only which displays a login box for an administrator account and then disables read only when the credentials are correct. That wouldn’t need write-access to the database I imagine (only read to check the credentials).