refactor(ha): passive standby model — primary connects outbound to all peers

Remove fetch_config_from_primary, ha_find_and_connect_to_primary, and the
tier-1/2/3 discovery path. Standbys never initiate outbound connections to
the primary; the primary owns all inter-controller channels.

Key changes:
- ha.c: add primary heartbeat loop (ha_start_primary_heartbeat) that sends
  OPCode_nop to connected standbys every heartbeat_interval_ms; loop
  self-cancels on demotion via role check before re-arm.
- ha.c: add outbound reconnect in primary_heartbeat_fn — for peers absent
  from standby_endpoints, open fresh outbound TLS connection (on_standby_connected
  sends ctrlhello; standby_ep_ctx_t mirrors vote_ep_ctx_t layout).
- ha.c: remove ha_find_and_connect_to_primary + helpers (ha_raw_tcp_connect,
  ha_tcp_connect_hook); remove election_timeout_fn (superseded by
  raft_election_timeout_fn); remove fetch_config_from_primary call from
  ha_elect_evaluate_and_signal STANDBY branch.
- cluster.c: OPCode_requestVote denial no longer reuses inbound connection;
  late joiners are bootstrapped via primary heartbeat outbound connect.
- config_repl.c: remove connect_ssl_raw, do_one_config_fetch,
  fetch_config_from_primary (~250 LOC).
- myapp.c: remove my_tag > 0 fetch branch; all standbys wait passively.
- ha.h: remove ha_find_and_connect_to_primary declaration + macros +
  ha_tcp_connect_hook seam; add ha_start_primary_heartbeat declaration.
- meson.build: remove test_ha_connect.c (tests deleted function).
- controller_test.c: remove test_ha_connect registration.
- CLAUDE.md, src/controller/CLAUDE.md: document passive standby model,
  inbound-vs-outbound connection ownership, async I/O constraint,
  heartbeat model.
- request.h: add xce_request declaration (removes scattered local externs).

src/controller/cluster.c

@@ -322,6 +322,11 @@ static int myreq_handler(vtask_t* task)
         reply.data_which                 = RequestReply_data_requestvotereplymsg;
         reply.data.requestvotereplymsg   = &vr_rep;
         xce_reply(ep, c->myhost, &reply);
+        /* Inbound vote connections are for voting only.  After the reply is
+         * sent the connection is left open until the remote side closes it.
+         * The primary will connect outbound to the newcomer from the heartbeat
+         * task if the peer is missing from standby_endpoints. */
+
         rc = 0;
         break;
     }
@@ -1258,9 +1263,6 @@ int cluster_run(cluster_t* c)
     return 0;
 }
 
-/* xce_request: defined in request.c, not yet in any public header */
-extern int xce_request(endpoint_t *ep, xce_request_t *req);
-
 /* ── Task 4.2: ha_send_ctrlhello_to_all_standbys ───────────────────────────
  *
  * Send OP_hello CtrlHelloRequest to every connected standby endpoint.