feat: ha_state_t, ha_config_t, ha_init/fini, role enum + config validation (P1-2)

- Full ha.h: ctrl_role_t enum (CTRL_PRIMARY/CTRL_STANDBY), ha_config_t,
  ha_state_t with _Atomic fields (term, role, applied_lsn, promotion
  counters, watchdog_stop), pthread_mutex_t lock, and public API.
- endpoint_t* omitted from ha_state_t — including netio.h would pull
  OpenSSL headers and risk circular deps; watchdog (P1-3) includes
  netio.h directly where needed.
- ha_init validates: heartbeat_interval_ms >= 2000, heartbeat_timeout_ms
  >= heartbeat_interval_ms, election_timeout_ms >= 500; returns -EINVAL
  on bad config; zeros struct and sets initial role to CTRL_STANDBY.
- ha_fini destroys mutex; watchdog thread join deferred to P1-3.
- am_i_primary / ha_promote_to_primary / ha_demote_to_standby are
  no-op stubs; cluster_t->ha field not yet wired (P1-5), so these avoid
  incomplete-type dereferences until then.
- TDD: 5 new tests in test_ha_role.c confirmed RED before implementation,
  all 5 GREEN after; all prior controller tests remain green.

src/controller/testsuite/controller_test.c

@@ -19,6 +19,7 @@ extern void test_e2e_checkpoint(void);
 extern void test_e2e_hooks(void);
 extern void test_e2e_gc(void);
 extern void test_e2e_capnp(void);
+extern void test_ha_role(void);
 
 void setUp(void) { return; }
 
@@ -107,6 +108,7 @@ int main(int argc, char* argv[])
     TEST(test_e2e_hooks);
     TEST(test_e2e_gc);
     TEST(test_e2e_capnp);
+    TEST(test_ha_role);
 
     return UNITY_END();
 }