feat(ha-config-bootstrap): add peer count and cert pre-flight validation (task 2.3)

- Implement validate_peer_count() in startup_validation.c: -EINVAL for even N>1
- Implement validate_cert_files() with err_buf output: access() check, writes
  missing path into err_buf, returns -ENOENT
- Wire validate_peer_count() in main.c after peer list parse; fatal exit on fail
- Wire validate_cert_files() in main.c before SSL init; fatal exit on fail
- Fix ASAN leak: SSL_CTX_free in ha_fini() with NULL guard
- Fix double-free: null c->ha.ssl_ctx in cluster_fini() before ha_fini(),
  so iomgr_fini() retains sole SSL_CTX ownership (design per ha.h comment)
- All 96 tests pass; all 12 ha_startup tests GREEN

.kiro/specs/ha-config-bootstrap/tasks.md

@@ -45,7 +45,7 @@ Dependency order: startup validation (D) unblocks vtaskmgr before election (A);
   - _Requirements: 4.3, 4.4_
   - _Boundary: Startup Validation (main.c, cluster.h, cluster.c)_
 
-- [ ] 2.3 Add peer count validation and cert pre-flight checks
+- [x] 2.3 Add peer count validation and cert pre-flight checks
   - In `main.c` after argument parsing: if `n_peers % 2 == 0 && n_peers > 1` → `fprintf(stderr, ...)` + `exit(1)` with message explaining odd-N requirement
   - Call `access(cert_path, R_OK)` and `access(key_path, R_OK)` in `main.c` before any SSL init; fatal exit with full path on failure
   - Fix ASAN leak: add `SSL_CTX_free(ha->ssl_ctx)` in `ha_fini()`