feat: add HA candidate failover to API server backend

- BackendConfig.Peers []string carries host:port candidates from YAML (backend.peers)
- RegisterToBackend iterates Peers in order, connecting to first responsive primary
- parsePeer extracted to peers.go (no build tag) so it's testable without CGO
- Single-host path (no Peers) preserved unchanged
- Tests: parsePeer table-driven (11 cases), stub RegisterToBackend with/without peers

src/frontend/apiserver/backend/stub_funcs_test.go

@@ -29,4 +29,31 @@ func TestEvalSelectForHost_StubErrNoCGO(t *testing.T) {
 func TestCleanup_StubNoOp(t *testing.T) {
 	// Should not panic and completes immediately
 	Cleanup()
+}
+
+// TestRegisterToBackend_StubSingleHost verifies the stub returns errNoCGO
+// for a single-host BackendConfig (no Peers).
+func TestRegisterToBackend_StubSingleHost(t *testing.T) {
+	err := RegisterToBackend(&BackendConfig{
+		Address: "ctrl01",
+		Port:    9990,
+		From:    "xce_apiserver",
+		Key:     "keepsecret$",
+	})
+	if err != errNoCGO {
+		t.Errorf("expected errNoCGO, got %v", err)
+	}
+}
+
+// TestRegisterToBackend_StubWithPeers verifies the stub returns errNoCGO
+// even when Peers are configured (HA mode), since CGO is not available.
+func TestRegisterToBackend_StubWithPeers(t *testing.T) {
+	err := RegisterToBackend(&BackendConfig{
+		Peers: []string{"ctrl01:9990", "ctrl02:9990"},
+		From:  "xce_apiserver",
+		Key:   "keepsecret$",
+	})
+	if err != errNoCGO {
+		t.Errorf("expected errNoCGO with peers configured, got %v", err)
+	}
 }